MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemusStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06
SHA3-384 hash:	075a9d7c3eb4f77611b88d68ae1e3830adfac2aa10aeb99437f7e9454569e229887aab1c70a66291fcb36ef9d6dee057
SHA1 hash:	16b04b4ff6c603920e47ebb2b32a524916d92276
MD5 hash:	7f82a0f059944604e98426265f51020f
humanhash:	quiet-thirteen-louisiana-idaho
File name:	1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06.exe
Download:	download sample
Signature	RemusStealer Create hunting rule
File size:	241'664 bytes
First seen:	2026-10-27 13:10:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	7926c98e202a78a109576db95224f1e0 (4 x RemusStealer)
ssdeep	3072:jsxf7x40mAh/u91EKRVL39XUIOHpMmYl5kh+Nsi3kKZzQ+q76vWnxbtZe:jal/IRXUIcpAFNseE+U6v2xDe
TLSH	T1D0343B2BC35336FCD692C07862693322B771B53C47309EF7029297359E61ED0AE79629
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Tuxxin
Tags:	exe RemusStealer

Intelligence

File Origin

# of uploads :

# of downloads :

164

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

xmrig

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2026-10-19 18:26:14 UTC

Tags:

auto metasploit framework github stealer stealc xmrig miner generic rustystealer loader babadeda crypter python opendir lumma possible-phishing solarisloader venom rat remcos formbook phorpiex botnet silentnet powershell evasion dcagentrmm pyinstaller telegram svc purelogs remusstealer solaris donutloader pastebin advancedinstaller arcticagent asyncrat ip-check phishing nemucod eclipse clickfix glamour adware datto rmm-tool payload vidar cobaltstrike tool coinminer xworm susp-powershell emmenhtal delphi reversessh action1 screenconnect rdp openssl pikabot abyssos remote acr onyxc2

Link:

https://app.any.run/tasks/79c3c25f-f264-4ee3-89b0-712f874e5541

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remus

Link:

https://www.capesandbox.com/analysis/95491/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae0a30b3a56bbccb37bef67

Tags:

infosteal stealer virus

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context fingerprint packed stealer

Link:

https://www.filescan.io/uploads/6ae0a2fa54b003f3665a7dae/reports/c93f62e5-79aa-455a-ab89-6ec323dc0b0b/overview

Verdict:

Malicious

Labled as:

Stealer.Generic

Link:

https://www.hybrid-analysis.com/sample/1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-19T08:35:00Z UTC

Last seen:

2026-10-29T09:54:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06/results?tab=lookup

Malware family:

Remus

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0dd92056-c10b-4107-99f2-b1721d4ccf86

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1992812

Signature

Clears process instrumentation callback through direct syscalls

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/7f82a0f059944604e98426265f51020f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06/

Threat name:

Win64.Trojan.Remus

Status:

Malicious

First seen:

2026-10-20 06:37:00 UTC

File Type:

PE+ (Exe)

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d3lmfx6bhdsx47wtlm7rxeqgtdychxcyxaxrpkrvpipcygoozuda._file

Verdict:

malicious

Label(s):

Remus

Link:

https://reports.threatray.com/138a5fc7-a5bc-45bd-ac97-dcee5ad88750

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/261027-qe5vrads8y/

Behaviour

Reads the TCP/IP host and domain name from the registry

Checks installed software on the system

Unpacked files

SH256 hash:

1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06

MD5 hash:

7f82a0f059944604e98426265f51020f

SHA1 hash:

16b04b4ff6c603920e47ebb2b32a524916d92276

Link:

https://www.unpac.me/results/37ea9f40-1d74-4f6b-95da-730666c77e3a/

Malware family:

Remus

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1ed6c2dfc138/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ed6c2dfc138e57e7ed35b3f1b920698f023dc58b82f17aa357a1e2c19cecd06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.