MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7
SHA3-384 hash: f602fb492e606211134fe800b13c529b9a7c2650ed57c4411bb20c65812b14d55a6d50ed1e194f19484a732610b68de0
SHA1 hash: be60a8bd8f382a33aa0593f1f90fe0a7c8e19521
MD5 hash: 0995d855ebe4ac29316ff6e0e8c05032
humanhash: september-harry-monkey-march
File name:0995d855ebe4ac29316ff6e0e8c05032.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:2'502'672 bytes
First seen:2026-08-19 18:30:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c2d457ad8ac36fc9f18d45bffcd450c2 (24 x CobaltStrike, 16 x Vidar, 15 x RemusStealer)
ssdeep 24576:ivFibKQo2pq4xt/55Vk/lK4c/5z5vUo4OmQXLWhwUQzKU7Jt:XbKQo2pq2Ec/5tvxR15Kg
TLSH T1A9C54B17BE4080B5C0AEE73589B34249BA75B84C873177D72FA1AE742F263C2A975F05
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe RemusStealer signed

Code Signing Certificate

Organisation:Quantum Ridge Solutions
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2026-08-08T02:41:20Z
Valid to:2027-08-15T02:41:20Z
Serial number: c9e25550e2125ed01a0d3becb0ed3f61
Thumbprint Algorithm:SHA256
Thumbprint: d4e60ac15fd47e0bd1e8fa351a45518687a6172fdbcfbfd68923733b9ec05cd5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemusStealer C2:
191.252.159.33:8539

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
191.252.159.33:8539 https://threatfox.abuse.ch/ioc/1871154/

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection:
Remus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82042/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Remus.32.10654.23804.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Query of malicious DNS domain
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-vm crypto downloader golang signed
Link:
https://www.filescan.io/uploads/6a85f656511572dd28f7d549/reports/b05ad8a9-7428-4a68-a197-1ba268ccf6cb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d2635ec6-29f6-4e61-9599-93057a54b2d6
Result
Threat name:
REMUS Stealer
Create hunting rule
Detection:
malicious
Classification:
evad.mine.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1960686
Signature
AI detected suspicious PE / MSI digital signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Creates multiple autostart registry keys
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses the Telegram API (likely for C&C communication)
Yara detected REMUS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1960686 Sample: zNNFUBhkRD.exe Startdate: 19/08/2026 Architecture: WINDOWS Score: 100 44 api.telegram.org 2->44 46 vexdico.shop 2->46 48 3 other IPs or domains 2->48 68 Suricata IDS alerts for network traffic 2->68 70 Found malware configuration 2->70 72 Antivirus detection for URL or domain 2->72 76 10 other signatures 2->76 9 zNNFUBhkRD.exe 1 2->9         started        14 HealthService.exe 2->14         started        signatures3 74 Uses the Telegram API (likely for C&C communication) 44->74 process4 dnsIp5 54 vexdico.shop 191.252.159.33, 49718, 49719, 49720 LocawebServicosdeInternetSABR Brazil 9->54 56 192.162.199.149, 49740, 80 FEMOITGB United Kingdom 9->56 58 bravplo.click 62.72.59.224, 7713 AS-HOSTINGERCY India 9->58 42 C:\Users\user\...\oaaRu43NZaim4VuBJTL9yi3.exe, PE32+ 9->42 dropped 82 Detected unpacking (creates a PE file in dynamic memory) 9->82 84 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->84 86 Tries to steal Mail credentials (via file / registry access) 9->86 94 7 other signatures 9->94 16 oaaRu43NZaim4VuBJTL9yi3.exe 2 16 9->16         started        88 Antivirus detection for dropped file 14->88 90 Multi AV Scanner detection for dropped file 14->90 92 Found evasive API chain (may stop execution after checking mutex) 14->92 file6 signatures7 process8 file9 36 C:\Users\user\AppData\...\SearchIndexer.exe, PE32+ 16->36 dropped 38 C:\Users\user\AppData\...\RuntimeBroker.exe, PE32+ 16->38 dropped 40 C:\Users\user\AppData\...\HealthService.exe, PE32+ 16->40 dropped 60 Antivirus detection for dropped file 16->60 62 Multi AV Scanner detection for dropped file 16->62 64 Found evasive API chain (may stop execution after checking mutex) 16->64 66 Creates multiple autostart registry keys 16->66 20 RuntimeBroker.exe 6 16->20         started        24 WMIC.exe 1 16->24         started        26 WMIC.exe 1 16->26         started        28 WMIC.exe 1 16->28         started        signatures10 process11 dnsIp12 50 api.telegram.org 149.154.166.110, 443, 49745 TELEGRAMVG United Kingdom 20->50 52 api.ipify.org 172.67.74.152, 443, 49744 CLOUDFLARENET-CloudflareIncUS Canada 20->52 78 Antivirus detection for dropped file 20->78 80 Multi AV Scanner detection for dropped file 20->80 30 conhost.exe 24->30         started        32 conhost.exe 26->32         started        34 conhost.exe 28->34         started        signatures13 process14
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/0995d855ebe4ac29316ff6e0e8c05032
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7/
Threat name:
Win64.Trojan.Remus
Create hunting rule
Status:
Suspicious
First seen:
2026-08-16 08:33:23 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dzgxf7fl5vhbj7giwlq3nj4sx23s6mdxvyb7sgtw2bamwdcfeddq._file
Verdict:
malicious
Label(s):
Remus
Create hunting rule
Link:
https://reports.threatray.com/4824ba11-8e56-4e28-ac82-216d0587d3c3
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:remus_stealer stealer
Link:
https://tria.ge/reports/260819-w5w87atsf1/
Behaviour
Family: Remus
Malware Config
C2 Extraction:
http://bravplo.click:7713/sessions
http://mrlketo.shop:8932/notifications
http://vexdico.shop:8539/imports
Unpacked files
SH256 hash:
1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7
MD5 hash:
0995d855ebe4ac29316ff6e0e8c05032
SHA1 hash:
be60a8bd8f382a33aa0593f1f90fe0a7c8e19521
Link:
https://www.unpac.me/results/beddd176-6fb5-45d7-817c-d2c9c0d719cc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1e4d72fcabed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1e4d72fcabed4e14fcc8b2e1b6a792beb72f3077ae03f91a76d040cb0c4520c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RemusStealer_GoPayload
Create hunting rule
Author:burger
Description:Detects RemusStealer Go-compiled payload
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82042/

Comments