remus_stealer | eaf66315dba6cc03706dee4c93873d2263c835a62956feff18a4b1eed1744478

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2hjrph1v.ooy.exe
Size 4.9MB
Sample260905-beyn4stfke
SHA256 eaf66315dba6cc03706dee4c93873d2263c835a62956feff18a4b1eed1744478
MD5 ba3639a313f3dff580389d2dad9f7618
SHA1 894e62f8ea43242baf2806832cdb03d206b295f9
SHA512 63e28160013379a33d4ab6c55bd0c6dc0ad504df6c4e3f2ea153fc0e1cade78b194571352e8bb5c3fc900959748d89b52decaa04effad2ca65a6474473a3e05b
SSDEEP 49152:5qYJ88e/Ekj2vCngdmI3Pg0yhOUlkracQO2VLiCZS3VElZWmwnP6JIF7s+lu:x2oisUJRkKwnP6qRdu
TLSH
T13D365C077A9940E0D465EA30C57F6263BA60BC8CC73672B32E4069742F7ABD075F6B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://clouven.click:8527/projects
http://bestals.shop:8592/folders
http://cdire.shop:9048/invoices

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

C:\Users\Admin\AppData\Local\Temp\2hjrph1v.ooy.exe
"C:\Users\Admin\AppData\Local\Temp\2hjrph1v.ooy.exe"
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000140000000-0x000000014003A000-memory.dmp

Download

memory/2936-1-0x0000000140000000-0x000000014003A000-memory.dmp