MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c
SHA3-384 hash: 3ddf3af5f2c55b367bce95076d3d0ad212ddfcfa57394122d68cea555d861ef05d52b1262dda4a17143721b8198918f3
SHA1 hash: 1916089385eb14eb255842b1cf7b0dd78fa57491
MD5 hash: e37b3d8780094609b9e378508bfb3ed1
humanhash: whiskey-high-west-sodium
File name:file
Download: download sample
Signature RemusStealer
Create hunting rule
File size:431'104 bytes
First seen:2026-07-12 20:57:14 UTC
Last seen:2026-07-13 06:18:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:Vbr7L840yOanwmB9UJ22SoXvrDAvBMIhmYPy9MvOt+Nf5BmdMin:VTL84eHc9Q/rDAZMI169MvOqaMin
Threatray 22 similar samples on MalwareBazaar
TLSH T1DF948E0991D1BC3DCD69BEB39E456481A09D5F0F97EC84E9914A3387FBB3EA0C42C51A
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon f0f0c8d4d4c8f8f0 (2 x RemusStealer)
Reporter Bitsight
Tags:c dropped-by-gcleaner exe MIX3.file RemusStealer


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
3
# of downloads :
207
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74354/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.29519627.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a53ffbc749f0a5acf20f0bd
Tags:
virus
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a53ffb72a2ab658a228b671/reports/da4974e2-9165-45a2-b2e9-d1b1e6ddef70/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-12T18:08:00Z UTC
Last seen:
2026-07-14T18:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ddec7524-c74b-4121-9725-0b624cc83969
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e37b3d8780094609b9e378508bfb3ed1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c/
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-07-12 20:57:39 UTC
File Type:
PE+ (Exe)
Extracted files:
18
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2avompwpsyhb6y3getsyrn5p5hm2ssars54ncuviw5pymus24wa._file
Verdict:
malicious
Label(s):
remus
Create hunting rule
Similar samples:
30add75b83a74e078a70e970d8ae2b604cac0d4a06e3e03bd61b9faeba64e5f3
RemusStealer
44814d2124603ec71ad8315b3992359039d0cf5f1f795042393438f6797eb38d
RemusStealer
523dd77b85d0b0cedc99ca23bc7225d4137b9e562a71a2d6d5e163e703680e2e
RemusStealer
5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c
RemusStealer
5eb378956ee84899b8ec8a59d0b9d5e95bef39cfce2acdfe72b032ea4e704227
RemusStealer
725700849bc04426ca22bdfcabfebde8612749058816e7cba8ceec442ee8848a
RemusStealer
7ae44ecd94c5e10f560e78539d4dba8b10d2ddcaf551d1321d81f7d97b771d5d
RemusStealer
7afb1a1dc8c72d5b4924d499464f5512264ef2021db5c2b8a9d0d9bda288e842
RemusStealer
ae887a7346ca3547c459962ff760fda8b221c16d96fcde758422586fe7a886e3
RemusStealer
error
RemusStealer
+ 12 additional samples on MalwareBazaar
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:remus_stealer discovery spyware stealer
Link:
https://tria.ge/reports/260712-zrskmaaz2w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: Remus
Malware Config
C2 Extraction:
http://tzpx.courses:4437
http://geminyw.xyz:5003
http://carogra.biz:4219
Unpacked files
SH256 hash:
5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c
MD5 hash:
e37b3d8780094609b9e378508bfb3ed1
SHA1 hash:
1916089385eb14eb255842b1cf7b0dd78fa57491
Link:
https://www.unpac.me/results/88fe6360-797f-4d9a-9727-d115fafd27c2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e815731f67c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe 5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74354/

Comments