🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 25 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4
SHA3-384 hash: f4de0b77685eb0c3ee7af202f533802e9ac4e928435002ed877386071abc7f55660a366d1a1a243cec2933fb172a2159
SHA1 hash: 9fa8b29dd095e2b6328f583b545ed0b3bffb7325
MD5 hash: 6c2e00e7634f0bd17de7629d9b8c5ab3
humanhash: jupiter-wolfram-single-floor
File name:newWILLIAM.bin
Download: download sample
Signature RemusStealer
Create hunting rule
File size:3'857'328 bytes
First seen:2026-10-28 23:11:04 UTC
Last seen:2026-10-28 23:27:02 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 4f2f006e2ecf7172ad368f8289dc96c1 (184 x SalatStealer, 80 x Vidar, 48 x RemusStealer)
ssdeep 49152:f61lz+q+gwwzUm8Z3dPWg9SpnQQZCBvPTnjEnxPI:if+q1PzCPWilpPTKxg
TLSH T1EF065C17BDA244A9C0AAE234C9A35252BB31BC0D4B3267D72E50F7382E7B7C15E79714
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter sarab
Tags:exe RemusStealer signed vidar

Code Signing Certificate

Organisation:Blue Circuit Holdings
Issuer:Blue Circuit Holdings
Algorithm:sha256WithRSAEncryption
Valid from:2026-10-21T19:44:49Z
Valid to:2027-10-28T19:44:49Z
Serial number: bca1aa44d9e04570e3f62a33e5075290
Thumbprint Algorithm:SHA256
Thumbprint: b2db140c85c539267a151ab9354dff621db833167f59e83065a8db2dc42500b6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
muha2xmad
https://www.virustotal.com/gui/file/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4/behavior

Intelligence

File Origin
# of uploads :
2
# of downloads :
209
Origin country :
EG EG
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-28 23:17:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/220668d1-4629-45c3-a5da-fbf71a750f2d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/95787/
Detection(s):
SecuriteInfo.com.W64.WinGo.J.gen.Eldorado.31992.15276.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae28116b175ade21dce6f5a
Tags:
extens trojan virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 crypto golang invalid-signature masquerade self-signed-cert signed
Link:
https://www.filescan.io/uploads/6ae281141c0bc12636c1957b/reports/2977e448-a62f-4942-bcf6-ab6effd2063c/overview
Verdict:
Malicious
Labled as:
WinGo/Kryptik.ABV trojan
Link:
https://www.hybrid-analysis.com/sample/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-28T18:50:00Z UTC
Last seen:
2026-10-30T17:56:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5d65423c-462b-4386-b5d1-57b8c1a39be8
Result
Threat name:
Salat Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994267
Signature
.NET source code contains process injector
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Adds extensions / path to Windows Defender exclusion list (Registry)
AI detected suspicious PE / MSI digital signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Creates a thread in another existing process (thread injection)
Creates files in the system32 config directory
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found strings related to Crypto-Mining
Found suspicious powershell code related to unpacking or dynamic code loading
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has nameless sections
Potential Privilege Escalation using Task Scheduler highest RunLevel
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Stop EventLog
Sigma detected: Suspicious Schtasks Execution AppData Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Salat Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994267 Sample: newWILLIAM.bin.exe Startdate: 29/10/2026 Architecture: WINDOWS Score: 100 112 pastebin.com 2->112 114 keyw0rd.com 2->114 116 10 other IPs or domains 2->116 144 Suricata IDS alerts for network traffic 2->144 146 Found malware configuration 2->146 148 Malicious sample detected (through community Yara rule) 2->148 152 24 other signatures 2->152 10 newWILLIAM.bin.exe 3 2->10         started        15 powershell.exe 2->15         started        17 grywncaphyug.exe 2->17         started        19 12 other processes 2->19 signatures3 150 Connects to a pastebin service (likely for C&C) 112->150 process4 dnsIp5 118 185.166.154.225, 49721, 8089 THENL Finland 10->118 120 keyw0rd.com 104.21.34.232, 443, 49700, 49710 CLOUDFLARENET-CloudflareIncUS Canada 10->120 122 bugerror.info 176.65.144.99, 443, 49701, 49704 DEDIK-CHGB Switzerland 10->122 96 C:\...\RVXoq30JeoPqDNoFaRVsXNokqBDk1.exe, PE32+ 10->96 dropped 98 C:\Users\...\Ji5gcw6o0uqJBZZau50FHyi89FqH.exe, PE32+ 10->98 dropped 100 C:\Users\...\FPoqwHJka8H64kTHDTs9B8RJ.exe, PE32+ 10->100 dropped 174 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->174 176 Tries to steal Mail credentials (via file / registry access) 10->176 178 Tries to harvest and steal ftp login credentials 10->178 196 4 other signatures 10->196 21 RVXoq30JeoPqDNoFaRVsXNokqBDk1.exe 10->21         started        25 FPoqwHJka8H64kTHDTs9B8RJ.exe 1 2 10->25         started        27 Ji5gcw6o0uqJBZZau50FHyi89FqH.exe 10->27         started        180 Creates files in the system32 config directory 15->180 182 Writes to foreign memory regions 15->182 184 Modifies the context of a thread in another process (thread injection) 15->184 30 dllhost.exe 15->30         started        32 conhost.exe 15->32         started        102 C:\Windows\Temp\aekuldpsjtxx.sys, PE32+ 17->102 dropped 186 Antivirus detection for dropped file 17->186 188 Adds a directory exclusion to Windows Defender 17->188 190 Sample is not signed and drops a device driver 17->190 34 cmd.exe 17->34         started        36 powershell.exe 17->36         started        38 3 other processes 17->38 192 Injects a PE file into a foreign processes 19->192 194 Unusual module load detection (module proxying) 19->194 40 2 other processes 19->40 file6 signatures7 process8 dnsIp9 90 C:\...\RVXoq30JeoPqDNoFaRVsXNokqBDk1.exe, PE32+ 21->90 dropped 154 Adds extensions / path to Windows Defender exclusion list (Registry) 21->154 156 Unusual module load detection (module proxying) 21->156 158 Found direct / indirect Syscall (likely to bypass EDR) 21->158 42 RVXoq30JeoPqDNoFaRVsXNokqBDk1.exe 21->42         started        92 C:\ProgramData\...\grywncaphyug.exe, PE32+ 25->92 dropped 160 Antivirus detection for dropped file 25->160 162 Modifies the context of a thread in another process (thread injection) 25->162 164 Adds a directory exclusion to Windows Defender 25->164 47 powershell.exe 23 25->47         started        49 dialer.exe 1 25->49         started        51 cmd.exe 1 25->51         started        59 4 other processes 25->59 126 45.151.100.245 LEASEWEB-NL-AMS-01NetherlandsNL United States 27->126 94 C:\Users\user\AppData\Local\...\jucheck.exe, PE32+ 27->94 dropped 166 Injects code into the Windows Explorer (explorer.exe) 30->166 168 Writes to foreign memory regions 30->168 170 Creates a thread in another existing process (thread injection) 30->170 172 Injects a PE file into a foreign processes 30->172 53 MicrosoftCacheAssistant.exe 30->53         started        61 2 other processes 34->61 55 conhost.exe 36->55         started        128 104.243.33.118 RELIABLESITE-ReliableSiteNetLLCUS United States 38->128 130 pastebin.com 172.66.171.73 CLOUDFLARENET-CloudflareIncUS Canada 38->130 57 conhost.exe 40->57         started        file10 signatures11 process12 dnsIp13 124 127.0.0.1 unknown unknown 42->124 104 C:\Users\user\AppData\Local\...\ggg.exe, PE32 42->104 dropped 106 C:\Users\user\AppData\...\taskmgr_hook.dll, PE32+ 42->106 dropped 108 C:\Users\user\AppData\...\WinRing0x64.sys, PE32+ 42->108 dropped 110 6 other malicious files 42->110 dropped 198 Creates multiple autostart registry keys 42->198 200 Uses schtasks.exe or at.exe to add and modify task schedules 42->200 202 Writes to foreign memory regions 42->202 214 3 other signatures 42->214 63 ggg.exe 42->63         started        68 schtasks.exe 42->68         started        70 schtasks.exe 42->70         started        204 Found suspicious powershell code related to unpacking or dynamic code loading 47->204 72 conhost.exe 47->72         started        206 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 49->206 74 conhost.exe 51->74         started        76 wusa.exe 51->76         started        208 Adds extensions / path to Windows Defender exclusion list (Registry) 53->208 210 Unusual module load detection (module proxying) 53->210 212 Found direct / indirect Syscall (likely to bypass EDR) 53->212 78 conhost.exe 59->78         started        80 conhost.exe 59->80         started        82 2 other processes 59->82 file14 signatures15 process16 dnsIp17 132 dns.google 8.8.4.4 GOOGLE-GoogleLLCUS United States 63->132 134 cloudflare-dns.com 104.16.248.249 CLOUDFLARENET-CloudflareIncUS Canada 63->134 136 sa1atik.cn 46.173.27.15 BEGET-ASRU Russia 63->136 88 C:\Program Files (x86)\...\yPklwjWU0riZjy.exe, PE32 63->88 dropped 138 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 63->138 140 Creates multiple autostart registry keys 63->140 142 Unusual module load detection (module proxying) 63->142 84 conhost.exe 68->84         started        86 conhost.exe 70->86         started        file18 signatures19 process20
Score:
24%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/6c2e00e7634f0bd17de7629d9b8c5ab3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4/
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-10-28 23:12:22 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=akvdkdf7x2vfjq3hpmva4jy4hgbp6aeampewj5iwkdlezuhon7ca._file
Verdict:
malicious
Label(s):
Remus
Create hunting rule
unc_loader_055
Create hunting rule
Link:
https://reports.threatray.com/9284633c-068d-4e93-8029-3ce18e09755f
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261028-26c5lavt7k/
Behaviour
Reads the TCP/IP host and domain name from the registry
Unpacked files
SH256 hash:
02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4
MD5 hash:
6c2e00e7634f0bd17de7629d9b8c5ab3
SHA1 hash:
9fa8b29dd095e2b6328f583b545ed0b3bffb7325
Link:
https://www.unpac.me/results/54cc752d-c425-4236-bc1d-5c565edd6e9d/
Malware family:
Remus
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02aa350cbfbe/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/02aa350cbfbeaa54c3677b2a0e271c3982ff008063c964f51650d64cd0ee6fc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:Remus
Create hunting rule
Author:kevoreilly
Rule name:RemusStealer_GoPayload
Create hunting rule
Author:burger
Description:Detects RemusStealer Go-compiled payload
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/95787/

Comments


Avatar
sarab commented on 2026-10-28 23:32:07 UTC

http://94.26.41.2/c2f/e/1a50135f8698'