MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemusStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 25 File information Comments

SHA256 hash:	c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687
SHA3-384 hash:	d632913ece228df9d032cd9237094f9ea088abee76d6acf62a245fb44950961530aafe583f4af5572191d1151e586b44
SHA1 hash:	899a61c8b123be664e3e18cf18c11316fe589396
MD5 hash:	1a586376b3ba1ead4c801ec189c708a1
humanhash:	lake-quiet-coffee-princess
File name:	7c1cc22a11e0d0a49ce86d1e5a2943922555860450d7ad6559ca7bc7c4eec99c.zip
Download:	download sample
Signature	RemusStealer Create hunting rule
File size:	3'821'474 bytes
First seen:	2026-10-04 20:12:42 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:Yht/IWHdScQJO/CW7hwph+3/16XDOfkanLUq8QkhyYmyHfnktxMCejTgh:Yh3HwjU65h+FDgq8myHfktxz6TE
TLSH	T16F068229978BE5B6C59D4130225F4BAF7AB181CE06A18306D3269C7E2CC3FD47F61E16
Magika	zip
Reporter	Kejult
Tags:	file-pumped Remus RemusStealer stealer zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
76.13.146.81:5203	https://threatfox.abuse.ch/ioc/1948835/

Intelligence

File Origin

# of uploads :

# of downloads :

230

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	7c1cc22a11e0d0a49ce86d1e5a2943922555860450d7ad6559ca7bc7c4eec99c.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	884'451'784 bytes
SHA256 hash:	7c1cc22a11e0d0a49ce86d1e5a2943922555860450d7ad6559ca7bc7c4eec99c
MD5 hash:	921503b88089eb1e5e8e74449e1c08d0
De-pumped file size:	12'028'416 bytes (Vs. original size of 884'451'784 bytes)
De-pumped SHA256 hash:	3a5ddc82c5ad3647fee3b4a11bc67d05ccd8a28777abd8ee708920393c55e44a
De-pumped MD5 hash:	5abc7e8f3ef276096a8601598e360973
MIME type:	application/x-dosexec
Signature	RemusStealer

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/51dd73a3-187d-4af9-af4c-8ef5a1720301/

Detection(s):

SecuriteInfo.com.FileRepMalware.61787296.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf55986f551121ba151219

Tags:

injection obfusc virus

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm bloated golang invalid-signature large-file overlay self-signed-cert signed

Link:

https://www.filescan.io/uploads/6ac2b35e22b99e170d1d0351/reports/c2e33610-2114-4241-8924-83ccf351b54d/overview

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687

Verdict:

Malicious

File Type:

zip

First seen:

2026-10-04T18:12:00Z UTC

Last seen:

2026-10-04T18:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RemusStealer_GoPayload Create hunting rule
Author:	burger
Description:	Detects RemusStealer Go-compiled payload

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	weird_zip_high_compression_ratio Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:	https://twitter.com/Cryptolaemus1/status/1633099154623803394

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

zip c34ebc389e99c4bfbddf726fc6f357aa625efb8afdf2abceef9454ab4026d687

(this sample)

RemusStealer

exe 3a5ddc82c5ad3647fee3b4a11bc67d05ccd8a28777abd8ee708920393c55e44a

Delivery method

Distributed via web download

Dropping

SHA256 3a5ddc82c5ad3647fee3b4a11bc67d05ccd8a28777abd8ee708920393c55e44a

Dropping

MD5 5abc7e8f3ef276096a8601598e360973

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample