🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25
SHA3-384 hash: edaf27bb9c5a96182986e51a5641dd0fe1275bce31a14dc0f9c9ea4ae9b096e27cdfa42d2aaefefa2227497b0bd664a3
SHA1 hash: 9e1a6dd1901d1cf6fb262e5ed98f41d6a41185a6
MD5 hash: e6bb8b8fc06683a0c2244b34cb42dade
humanhash: speaker-lake-skylark-timing
File name:80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:56'320 bytes
First seen:2026-10-01 05:27:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 1536:cSYu6f0qrycmV2RETMJgUvVXkq5iyFz3A9:xYavcE6gkVXkqn93A9
TLSH T1C043392992D543B5D91BC238D9F89367D160F441AA324FEF03D2DD4F1BAB961B20CBA1
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter Tuxxin
Tags:exe RemusStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1ca80be2-0ece-49da-a2cc-6fd2053c4700/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
Still cant find it.zip
Verdict:
Malicious activity
Analysis date:
2026-09-30 17:07:09 UTC
Tags:
auto metasploit framework processhacker tool kprocesshacker-sys vuln-driver inno installer opendir evasion python stealer stealc github phorpiex botnet generic loader powershell possible-phishing solaris dsys rat telegram screenconnect rdp rmm-tool remote svc silentnet xmrig miner arcticagent asyncrat venom remusstealer nemucod glamour donutloader tinynuke putty clickfix rustystealer ip-check adware action1rmm phishing acr pastebin cobaltstrike datto cryptolocker ransomware cryptowall havoc networm amus autoit gh0st websocket koiloader action1 susp-powershell aokigahara remus pyinstaller coinminer meterpreter arch-exec arch-doc xworm dcagentrmm guloader reversessh delphi bruteratel winring0-sys arch-scr arch-html
Link:
https://app.any.run/tasks/bd501935-a19a-416a-9498-52081b612e40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89994/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ace8e8d350c7ee8cc15216d
Tags:
emotet agentb ewind mint
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Connection attempt to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Mint.Phil.Generic
Link:
https://www.hybrid-analysis.com/sample/80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-26T17:31:00Z UTC
Last seen:
2026-10-03T01:48:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b562bc2c-5526-4b6d-be36-16f128a95657
Result
Threat name:
SolarisLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1980381
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to log keystrokes
Creates a thread in another existing process (thread injection)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries Google from non browser process on port 80
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Writes to foreign memory regions
Yara detected SolarisLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1980381 Sample: 0OMZ2Vlml6.exe Startdate: 01/10/2026 Architecture: WINDOWS Score: 100 27 www.google.com 2->27 29 pki-goog.l.google.com 2->29 31 c.pki.goog 2->31 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 6 other signatures 2->43 6 0OMZ2Vlml6.exe 1 11 2->6         started        10 wlrmdr.exe 10 2->10         started        13 sihost.exe 2->13 injected 15 explorer.exe 52 7 2->15 injected signatures3 process4 dnsIp5 17 C:\Users\user\AppData\Roaming\...\wlrmdr.exe, PE32+ 6->17 dropped 19 C:\Users\user\AppData\Local\...\64c7r41d.exe, PE32+ 6->19 dropped 21 C:\Users\user\...\wlrmdr.exe:Zone.Identifier, ASCII 6->21 dropped 45 Found evasive API chain (may stop execution after checking mutex) 6->45 47 Changes the view of files in windows explorer (hidden files and folders) 6->47 49 Contains functionality to inject threads in other processes 6->49 57 8 other signatures 6->57 33 193.178.158.107, 49745, 49746, 49747 IPC-ASRU Russia 10->33 35 www.google.com 142.251.153.119, 49743, 49751, 80 GOOGLE-GoogleLLCUS United States 10->35 23 C:\Users\user\AppData\Local\...\nqfglf6n.exe, PE32 10->23 dropped 25 C:\Users\user\AppData\Local\...\ancppmnn.exe, PE32+ 10->25 dropped 51 Antivirus detection for dropped file 10->51 53 Multi AV Scanner detection for dropped file 10->53 55 Injects code into the Windows Explorer (explorer.exe) 10->55 file6 signatures7
Score:
54%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e6bb8b8fc06683a0c2244b34cb42dade
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25/
Threat name:
Win64.Trojan.MintPhil
Create hunting rule
Status:
Malicious
First seen:
2026-09-28 01:03:56 UTC
File Type:
PE+ (Exe)
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qc6xdajou7bvmnhv6winqdv5xipkt6ec5bur5gcuxg3csfxoj4sq._file
Result
Malware family:
solaris_loader
Create hunting rule
Score:
  10/10
Tags:
family:solaris_loader defense_evasion discovery loader persistence privilege_escalation
Link:
https://tria.ge/reports/261001-f54ehaxbng/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Checks computer location settings
Executes dropped EXE
Family: SolarisLoader
Malware Config
C2 Extraction:
193.178.158.107
193.178.158.65
196.251.107.186
Unpacked files
SH256 hash:
80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25
MD5 hash:
e6bb8b8fc06683a0c2244b34cb42dade
SHA1 hash:
9e1a6dd1901d1cf6fb262e5ed98f41d6a41185a6
Detections:
SUSP_XORed_Mozilla
Create hunting rule
Link:
https://www.unpac.me/results/406c2293-e2fc-4d3d-b10b-6a80c2c6c23e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hunt_Obfuscated_Localhost_ROT
Create hunting rule
Author:Serhii Kocherhan
Description:Detects obfuscated/rotated 127.0.0.1 strings while excluding raw plaintext
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe 80bd71812ea7c35634f5f590d80ebdba1ea9f882e8691e9854b9b62916ee4f25

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3896700/
  
URLhaus
https://urlhaus.abuse.ch/url/3915289/
Cape
Cape
https://www.capesandbox.com/analysis/89994/

Comments