🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 30 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02
SHA3-384 hash: c33c6155a8a6009206365c7afdd43cd1f9ccfcbb8a4bd019968a9186b4239e52c7e8350d8ad440efe599d9096d5e806d
SHA1 hash: 7bafb786a4079e616f448a5325270a8952269098
MD5 hash: 219811d86a84844199c1d502295e15b6
humanhash: five-table-fanta-failed
File name:file.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:930'576 bytes
First seen:2026-10-07 12:10:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 264af3251c413a17cf5b344665eae973 (2 x GCleaner, 1 x RemusStealer)
ssdeep 24576:cNVls7y8yuRGvzNUW+ExexPzAishglLL9E1g:cNJ3A3IkRAis2RLS1g
TLSH T1A0158E22A3D34433D1721A7D8D1B56649B2A7F033D37E9492AF40B4C2E3978976363A7
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (573 x Quakbot, 338 x GCleaner, 137 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RemusStealer


Avatar
abuse_ch
RemusStealer C2:
45.55.202.73:9932

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.55.202.73:9932 https://threatfox.abuse.ch/ioc/1955703/

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-07 12:19:38 UTC
Tags:
gcleaner loader auto generic auto-reg salatstealer stealer onyxc2 golang susp-powershell smtp delphi inno installer
Link:
https://app.any.run/tasks/32a35670-f906-444c-af11-2caad30599c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90979/
Detection(s):
SecuriteInfo.com.W32.Injector.ETZT.tr.9170.2323.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad03a47f4e17c78f715614e
Tags:
cobalt delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Deleting a recently created file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi evasive expired-cert fingerprint invalid-signature keylogger packed signed
Link:
https://www.filescan.io/uploads/6ac636ba53f92ec6abcaae88/reports/a495e013-dcc3-4175-b786-9c67ef143419/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-07T08:53:00Z UTC
Last seen:
2026-10-09T10:13:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/22f0a3bb-f133-4ad7-94b0-3199167f201c
Result
Threat name:
CryptOne, GCleaner, Salat Stealer
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1983510
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Drops PE files with benign system names
Found malware configuration
Hijacks the control flow in another process
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Suspicious access to claude desktop data directory by non-Claude process
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to detect sleep reduction / modifications
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected Salat Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1983510 Sample: file.exe Startdate: 07/10/2026 Architecture: WINDOWS Score: 100 117 45.91.200.135 PODAONLV Netherlands 2->117 119 185.156.73.98 FDN3UA Russia 2->119 121 16 other IPs or domains 2->121 149 Suricata IDS alerts for network traffic 2->149 151 Found malware configuration 2->151 153 Malicious sample detected (through community Yara rule) 2->153 155 13 other signatures 2->155 11 file.exe 2->11         started        14 explorer.exe 2->14 injected 17 0OEOFwQIPL.exe 2->17         started        20 2 other processes 2->20 signatures3 process4 dnsIp5 179 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->179 181 Hijacks the control flow in another process 11->181 183 Contains functionality to inject code into remote processes 11->183 193 4 other signatures 11->193 22 svchost.exe 70 11->22         started        131 migelgarciapakota.club 104.21.47.73 CLOUDFLARENET-CloudflareIncUS Canada 14->131 185 System process connects to network (likely due to code injection or exploit) 14->185 187 Tries to steal Instant Messenger accounts or passwords 14->187 189 Tries to steal Mail credentials (via file / registry access) 14->189 195 4 other signatures 14->195 79 C:\ProgramData\aiiyokjhjyhceo.exe, PE32+ 17->79 dropped 191 Adds a directory exclusion to Windows Defender 17->191 27 cmd.exe 17->27         started        29 557pkySN8kFM.exe 20->29         started        31 557pkySN8kFM.exe 20->31         started        file6 signatures7 process8 dnsIp9 123 91.92.242.236, 49753, 80 OMEGATECH-ASSC Netherlands 22->123 125 drive.usercontent.google.com 142.251.211.161, 443, 49751 GOOGLE-GoogleLLCUS United States 22->125 101 C:\Users\user\AppData\...\q5tMRXG1T.exe, PE32+ 22->101 dropped 103 C:\Users\user\AppData\...\30Rlr1T9o6vNK.exe, PE32+ 22->103 dropped 105 C:\Users\user\AppData\...\qGvNhSQh8U.exe, PE32+ 22->105 dropped 107 22 other malicious files 22->107 dropped 171 System process connects to network (likely due to code injection or exploit) 22->171 173 Unusual module load detection (module proxying) 22->173 33 30Rlr1T9o6vNK.exe 22->33         started        36 LV9TV77Vbm6p.exe 22->36         started        39 557pkySN8kFM.exe 1 22->39         started        45 11 other processes 22->45 175 Suspicious powershell command line found 27->175 177 Adds a directory exclusion to Windows Defender 27->177 41 conhost.exe 27->41         started        43 powershell.exe 27->43         started        file10 signatures11 process12 dnsIp13 81 C:\ProgramData\...\MicrosoftEdgeSecurity.exe, PE32+ 33->81 dropped 48 MicrosoftEdgeSecurity.exe 33->48         started        53 cmd.exe 33->53         started        55 cmd.exe 33->55         started        157 Multi AV Scanner detection for dropped file 36->157 159 Injects code into the Windows Explorer (explorer.exe) 36->159 161 Writes to foreign memory regions 36->161 169 3 other signatures 36->169 163 Drops PE files with benign system names 39->163 165 Unusual module load detection (module proxying) 39->165 57 557pkySN8kFM.exe 3 4 39->57         started        127 185.166.155.61 THENL Finland 45->127 129 185.99.97.21 GCS-ASGB Finland 45->129 83 C:\Users\user\AppData\Local\...\vCtgGHLrw.tmp, PE32 45->83 dropped 167 Adds a directory exclusion to Windows Defender 45->167 59 vCtgGHLrw.tmp 3 5 45->59         started        61 conhost.exe 45->61         started        63 conhost.exe 45->63         started        65 4 other processes 45->65 file14 signatures15 process16 dnsIp17 109 simplswop.io 104.21.25.89 CLOUDFLARENET-CloudflareIncUS Canada 48->109 85 C:\Users\user\AppData\Local\Temp\update.exe, PE32 48->85 dropped 87 C:\Users\user\AppData\...\ONBQCLYSPU.xlsx, ASCII 48->87 dropped 89 C:\Users\user\AppData\...89WTVCDUMOB.png, ASCII 48->89 dropped 91 C:\Users\user\AppData\...\HTAGVDFUIE.pdf, ASCII 48->91 dropped 133 Tries to harvest and steal browser information (history, passwords, etc) 48->133 135 Writes to foreign memory regions 48->135 137 Allocates memory in foreign processes 48->137 147 4 other signatures 48->147 67 chrome.exe 48->67         started        139 Suspicious powershell command line found 53->139 141 Uses schtasks.exe or at.exe to add and modify task schedules 53->141 143 Adds a directory exclusion to Windows Defender 53->143 69 conhost.exe 53->69         started        71 schtasks.exe 53->71         started        73 conhost.exe 55->73         started        75 timeout.exe 55->75         started        111 dns.google 8.8.8.8 GOOGLE-GoogleLLCUS United States 57->111 113 j.sni.global.fastly.net 151.101.2.132 FASTLY-FastlyIncUS Canada 57->113 115 3 other IPs or domains 57->115 93 C:\Program Files (x86)\...\kM95OXs31.exe, PE32 57->93 dropped 95 C:\Program Files (x86)\MSECache\spoolsv.exe, PE32 57->95 dropped 145 Creates multiple autostart registry keys 57->145 97 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 59->97 dropped 99 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 59->99 dropped file18 signatures19 process20 process21 77 WerFault.exe 67->77         started       
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/219811d86a84844199c1d502295e15b6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-07 12:10:31 UTC
File Type:
PE (Exe)
Extracted files:
68
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xh44ldqib4nvakhi4my73qfklvoegzdnorydcyk5izcyad7ipiba._file
Verdict:
malicious
Label(s):
SalatStealer
Create hunting rule
Link:
https://reports.threatray.com/b873ec86-f260-4d39-9ca9-1ee2be498367
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:gcleaner defense_evasion discovery execution installer loader persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261007-pb9tvsgw2y/
Behaviour
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Script User-Agent
Scheduled Task/Job: Scheduled Task
Modifies registry class
Enumerates system info in registry
Delays execution with timeout.exe
Checks processor information in registry
Inno Setup is an open-source installation builder for Windows applications.
Executes a command shell one-liner
Browser Information Discovery
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Creates a file in the Startup directory
Downloads MZ/PE file
Suspicious use of NtCreateUserProcessOtherParentProcess
Family: GCleaner
Family: DonutLoader
Detects DonutLoader
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02
MD5 hash:
219811d86a84844199c1d502295e15b6
SHA1 hash:
7bafb786a4079e616f448a5325270a8952269098
Link:
https://www.unpac.me/results/eafdeab7-1f81-4f0c-bdc4-c2a11d1b1188/
SH256 hash:
3a8bd3de3c2bd55078e1cee0f21340caa20950d34182e5e9e003132a25fdd2e4
MD5 hash:
c1acd10cabc5d915b05a907807f04e74
SHA1 hash:
d42708c3e88c410ee09397bc8c06961fedd2907d
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/eafdeab7-1f81-4f0c-bdc4-c2a11d1b1188/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b9f9c58e080f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Venus Locker
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_SliverFox_ForgeAuto_c1e18461
Create hunting rule
Author:Marjoriefort
Description:Detects SliverFox (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4286e0e1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_598a7881_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_99cdfd72_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_bd254b5c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/90979/
  
URLhaus
https://urlhaus.abuse.ch/url/3913054/
  
Delivery method
Distributed via web download

Comments