🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe
SHA3-384 hash: e57e5c618be1eea2aae138970cb612aa346ab421e3c68a7c714776930eae9b305ffb072d2960f6b75f86dde8207f0301
SHA1 hash: 3e6bcfc6a14a1e60459cce6625b6354ce5428493
MD5 hash: 0a7f8a3e8e5c4e70f7ec2863a70c95e0
humanhash: one-hawaii-louisiana-hawaii
File name:0a7f8a3e8e5c4e70f7ec2863a70c95e0.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:17'041'920 bytes
First seen:2026-10-08 14:10:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 3e3c7cd3783c316bb26868db037273eb (3 x RemusStealer)
ssdeep 393216:9JvdVFh+3l3Y7My4QtgEZOtd+r0UXqx6xJlQW:3dVkzhQKN8j6yD
TLSH T15E07330018D72CC9F527E7FED94116099EBAB6606608929EAA7A4F5A1F3F173C177330
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon fc3749494f4df1dd (2 x RemusStealer)
Reporter abuse_ch
Tags:exe RemusStealer


Avatar
abuse_ch
RemusStealer C2:
15.204.253.8:5621

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
15.204.253.8:5621 https://threatfox.abuse.ch/ioc/1956223/

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
amadey
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-08 14:19:22 UTC
Tags:
maldoc payload loader solaris amadey botnet stealer auto-reg delphi inno installer python stealc cryptbot
Link:
https://app.any.run/tasks/96017cc1-77fa-4584-bbed-c49ff5b1c83c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91116/
Detection(s):
SecuriteInfo.com.Trojan.Siggen34.43012.2534.9943.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
DNS request
Creating a file
Connection attempt
Sending an HTTP GET request
Launching a process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Changing a file
Running batch commands
Launching the process to change network settings
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Launching a file downloaded from the Internet
Stealing user critical data
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug exploit explorer lolbin microsoft_visual_cc obfuscated packed reconnaissance
Link:
https://www.filescan.io/uploads/6ac7a453ee212dec8e49755f/reports/9cc9b461-f930-4053-b8cd-a623727adf34/overview
Verdict:
Malicious
Labled as:
Mikey.Generic
Link:
https://www.hybrid-analysis.com/sample/9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-27T14:23:00Z UTC
Last seen:
2026-10-09T21:25:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d0ee5b1-16ca-4dd5-9787-ee222d393603
Result
Threat name:
SolarisLoader, Stealc v2, SvcStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1984249
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Found API chain matching a thread downloading files from the Internet
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Queries Google from non browser process on port 80
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: Files With System Process Name In Unsuspected Locations
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected SolarisLoader
Yara detected Stealc v2
Yara detected SvcStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1984249 Sample: ZVq8kJxJfA.exe Startdate: 08/10/2026 Architecture: WINDOWS Score: 100 128 gd4o2mlqlnhfyux987ekchvglluznifbeeioxln50wbrkoakvbd.com 2->128 130 cryonex.sbs 2->130 132 www.google.com 2->132 144 Suricata IDS alerts for network traffic 2->144 146 Found malware configuration 2->146 148 Malicious sample detected (through community Yara rule) 2->148 150 11 other signatures 2->150 11 ZVq8kJxJfA.exe 38 2->11         started        16 wlrmdr.exe 2->16         started        18 explorer.exe 72 8 2->18 injected 20 5 other processes 2->20 signatures3 process4 dnsIp5 142 193.178.158.107, 49737, 49738, 49740 IPC-ASRU Russia 11->142 110 C:\Users\user\Desktop\SilverBulletPro.exe, PE32+ 11->110 dropped 112 C:\Users\user\AppData\Local\...\yqtum2ut.exe, PE32+ 11->112 dropped 114 C:\Users\user\AppData\Local\...\ybssw4xb.exe, PE32+ 11->114 dropped 124 4 other malicious files 11->124 dropped 198 Found API chain matching a thread downloading files from the Internet 11->198 22 h75rp6gb.exe 1 14 11->22         started        27 6bp41fq8.exe 11->27         started        29 gxxbd0g3.exe 11->29         started        39 4 other processes 11->39 116 C:\Users\user\AppData\Local\...\y8kwogoj.exe, PE32+ 16->116 dropped 118 C:\Users\user\AppData\Local\...\js6rq2ux.exe, PE32+ 16->118 dropped 120 C:\Users\user\AppData\Local\...\cq44h56k.exe, PE32+ 16->120 dropped 122 C:\Users\user\AppData\Local\...\9g3w44dr.exe, PE32+ 16->122 dropped 200 Multi AV Scanner detection for dropped file 16->200 202 Contains functionality to inject threads in other processes 16->202 204 Injects code into the Windows Explorer (explorer.exe) 16->204 212 3 other signatures 16->212 31 y8kwogoj.exe 16->31         started        33 js6rq2ux.exe 16->33         started        35 syshost.exe 18->35         started        41 3 other processes 18->41 206 Changes memory attributes in foreign processes to executable or writable 20->206 208 Writes to foreign memory regions 20->208 210 Allocates memory in foreign processes 20->210 214 2 other signatures 20->214 37 schtasks.exe 20->37         started        file6 signatures7 process8 dnsIp9 134 193.178.158.57, 49823, 80 IPC-ASRU Russia 22->134 136 www.google.com 142.251.153.119, 49758, 49762, 80 GOOGLE-GoogleLLCUS United States 22->136 82 C:\Users\user\AppData\Roaming\...\wlrmdr.exe, PE32+ 22->82 dropped 84 C:\Users\user\AppData\Local\...\rt36asgz.exe, PE32+ 22->84 dropped 86 C:\Users\user\AppData\Local\...\i8qv1e2a.exe, PE32+ 22->86 dropped 96 3 other malicious files 22->96 dropped 152 Antivirus detection for dropped file 22->152 154 Multi AV Scanner detection for dropped file 22->154 156 Changes the view of files in windows explorer (hidden files and folders) 22->156 174 2 other signatures 22->174 43 i8qv1e2a.exe 22->43         started        47 rt36asgz.exe 22->47         started        158 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 27->158 160 Writes to foreign memory regions 27->160 176 3 other signatures 27->176 49 HelpPane.exe 27->49         started        88 C:\Users\user\AppData\Local\...\gxxbd0g3.tmp, PE32 29->88 dropped 51 gxxbd0g3.tmp 29->51         started        138 109.238.86.106, 49848, 80 PIONEERNETRU United Kingdom 31->138 162 Tries to harvest and steal browser information (history, passwords, etc) 31->162 164 Injects a PE file into a foreign processes 31->164 166 Injects code into the Windows Explorer (explorer.exe) 35->166 168 Creates a thread in another existing process (thread injection) 35->168 53 conhost.exe 37->53         started        90 C:\Users\user\AppData\...\winupdatejdl.exe, PE32+ 39->90 dropped 92 C:\Users\user\AppData\Roaming\syshost.exe, PE32+ 39->92 dropped 94 C:\Users\user\AppData\Roaming\synchost.exe, PE32+ 39->94 dropped 170 Creates multiple autostart registry keys 39->170 172 Contains functionality to inject threads in other processes 39->172 55 synchost.exe 39->55         started        58 syshost.exe 39->58         started        file10 signatures11 process12 dnsIp13 98 C:\Users\user\...\SystemServiceManager.exe, PE32+ 43->98 dropped 100 C:\Users\user\AppData\...\MsEdgeUpdate.xml, XML 43->100 dropped 178 Multi AV Scanner detection for dropped file 43->178 180 Changes memory attributes in foreign processes to executable or writable 43->180 182 Uses schtasks.exe or at.exe to add and modify task schedules 43->182 194 4 other signatures 43->194 60 schtasks.exe 43->60         started        102 C:\Users\user\AppData\...\places.sqlite-shm, data 49->102 dropped 104 C:\Users\user\AppData\...\cookies.sqlite-shm, data 49->104 dropped 184 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 49->184 186 Tries to harvest and steal browser information (history, passwords, etc) 49->186 188 Writes to foreign memory regions 49->188 196 3 other signatures 49->196 106 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 51->106 dropped 108 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 51->108 dropped 62 gxxbd0g3.exe 51->62         started        140 196.251.107.186, 49745, 49748, 49750 FEMOITGB Germany 55->140 190 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 55->190 192 Contains functionality to inject threads in other processes 58->192 65 conhost.exe 58->65         started        file14 signatures15 process16 file17 67 conhost.exe 60->67         started        126 C:\Users\user\AppData\Local\...\gxxbd0g3.tmp, PE32 62->126 dropped 69 gxxbd0g3.tmp 62->69         started        process18 file19 74 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 69->74 dropped 76 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 69->76 dropped 78 C:\ProgramData\...\vcruntime140_1.dll (copy), PE32+ 69->78 dropped 80 11 other malicious files 69->80 dropped 72 FnHotkeyUtility.exe 69->72         started        process20
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe/
Threat name:
Win64.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2026-09-27 19:19:37 UTC
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tp3op7msjksk76jlwxnqobovgahhu3qztrz34l6jxxwltamrst7a._file
Result
Malware family:
svcstealer
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:solaris_loader family:svcstealer discovery downloader execution installer loader persistence privilege_escalation stealer trojan
Link:
https://tria.ge/reports/261008-rgxgtshv8q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Detects SvcStealer Payload
Family: Amadey
Family: SolarisLoader
Family: SvcStealer, Diamotrix
Malware Config
C2 Extraction:
193.178.158.107
193.178.158.65
196.251.107.186
Unpacked files
SH256 hash:
9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe
MD5 hash:
0a7f8a3e8e5c4e70f7ec2863a70c95e0
SHA1 hash:
3e6bcfc6a14a1e60459cce6625b6354ce5428493
Link:
https://www.unpac.me/results/9969b9cc-3653-49ba-8168-a2982eaedc8c/
Malware family:
SolarisLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9bf6e7fd924a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bf6e7fd924aa4aff92bb5db0705d5300e7a6e199c73be2fc9bdecb9819194fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of MFA browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_References_SecTools
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many IR and analysis tools
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:recordbreaker_win_generic
Create hunting rule
Author:_kphi
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91116/

Comments