MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemusStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b
SHA3-384 hash:	a7b4a808644beca928277bb63dbc040d1430b7e3d43e7b7c66ac4f05ef8f30aa88695d952d64c356976be3edc9a0683c
SHA1 hash:	c4f52c7603762413f46f8b5d42dfdd4f80f9ebb0
MD5 hash:	0079349e533d6060bc6d731e0467ede7
humanhash:	virginia-aspen-hotel-bluebird
File name:	sunwukongs.exe
Download:	download sample
Signature	RemusStealer Create hunting rule
File size:	702'176 bytes
First seen:	2026-05-15 20:37:58 UTC
Last seen:	2026-06-08 09:46:39 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:WTpTlxEwPQHIqaIt9Ck3kBK/Z8wULwkkqCbrOZEoeEeS3E6/1U6UFR67/JTWAnSd:WTpxxEwPQHIqaIt9Ck3kBK/Z8wULwkk9
TLSH	T1A6E476BFC0E45BD1D5687273802ABB3E5B25BCB560A251CF16523313ED3A46E8E16336
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	f0e8d496ccccf0f0 (1 x RemusStealer, 1 x Rhadamanthys, 1 x Stealc)
Reporter	aachum
Tags:	dropped-by-OffLoader exe RemusStealer signed SunWukong

Code Signing Certificate

Organisation:	Hahn Inc
Issuer:	Hahn Inc Intermediate CA 3
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-11-15T11:18:02Z
Valid to:	2028-05-15T11:18:02Z
Serial number:	01cec856eba6c6bf
Thumbprint Algorithm:	SHA256
Thumbprint:	ef2bc5296e176eab117c1084dabf0f139b4b8603eaeeb6a80898592b58a184de
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

iamaachum

http://plasteredplayn.com/sunwukongs.exe

RemusStealer C2:
dafkov.shop (89.117.56.119:6843)

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

main.exe

Verdict:

Malicious activity

Analysis date:

2026-05-15 15:25:28 UTC

Tags:

auto xworm rat phorpiex botnet ipfs phishing massbass github possible-phishing stealc stealer python tinynuke powershell loader rustystealer generic quasar violetworm worm cobaltstrike tool adware remcos screenconnect rmm-tool remote action1rmm clickfix telegram guloader pastebin njrat havoc remus autoit evasion datto coinminer miner xenorat action1 gotohttp delphi pushware networm amus salatstealer pythonstealer dattormm susp-powershell api-base64 cryptowall ransomware putty santastealer ammy donutloader rustdesk emotet heodo koiloader autohotkey stealerium meterpreter discord gh0st redline muckstealer asyncrat susp-script ramnit vidar chromelevator xmrig whitesnakestealer rdp wannacry jigsaw netreactor ghostsocks proxyware jeefo agenttesla metasploit dcrat whitesnake websocket bruteratel smb lumma scan smbscan hijackloader braodo

Link:

https://app.any.run/tasks/e9cece69-1e36-47fa-9f17-1f98736e4d0d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66068/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.39558366.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a07843c46d6967b3d90959a

Tags:

injection obfusc crypt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

installer-heuristic packed signed

Link:

https://www.filescan.io/uploads/6a078437efbd399b39b1eb0c/reports/461687cc-b224-4a55-9f36-2b964bff167e/overview

Verdict:

Suspicious

Labled as:

Kryptik.HZHD trojan

Link:

https://www.hybrid-analysis.com/sample/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-05-15T13:45:00Z UTC

Last seen:

2026-05-17T16:38:00Z UTC

Hits:

~100

Detections:

Backdoor.Agent.HTTP.C&C Trojan.Win32.Injuke.ppcf PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/9b9cabd9-e7d0-4371-a138-ef99d5392b1b

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1914269

Signature

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Score:

49%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/0079349e533d6060bc6d731e0467ede7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b/

Verdict:

Malicious

Threat:

Trojan.Win32.Injuke

Link:

https://tip.neiki.dev/file/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-05-15 18:26:12 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rgy3hsgm3stqi37danq7d7m6oc6vahnoukritch7uaumgqumnafq._file

Verdict:

malicious

Label(s):

remus

Similar samples:

error

RemusStealer

Gathering data

Unpacked files

SH256 hash:

89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b

MD5 hash:

0079349e533d6060bc6d731e0467ede7

SHA1 hash:

c4f52c7603762413f46f8b5d42dfdd4f80f9ebb0

Link:

https://www.unpac.me/results/dfe3c14b-6049-47ad-bed9-2435effcc916/

Malware family:

RemusStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/89b1b3c8ccdc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.