MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef
SHA3-384 hash:	b090fbd2add2c099d95d1b5cd29887b03cd7aae4e80ba4385aaddf36f9218fd3cd8961846da8762deb55b16c1a3e80ca
SHA1 hash:	f2eed6018f5e1bc8dbbf9145e6b24395e952ddc9
MD5 hash:	356da0ec0a8ee0dbbce0a40f84b960a9
humanhash:	kilo-twelve-bulldog-virginia
File name:	d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef
Download:	download sample
Signature	RemusStealer Alert Create hunting rule
File size:	224'256 bytes
First seen:	2026-07-23 13:29:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	17081ce96f78327d576e14ddd5592fba (8 x RemusStealer)
ssdeep	3072:IKfPZ5SQdMDqhf6h8Yv50xTXa84P/UKydVnGGOV80QIS6MtWGaTNcAzU/zb:XJYWPrnJwQI2ccAz
TLSH	T1A324396BD25330FCD552C078826A7232B772BA3D47249EF743A3C7369E219C06E79925
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe hairkeratin-net RemusStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

157

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75805/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Stealer.535.17321863.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Query of malicious DNS domain

Hybrid Analysis Stealer.Generic

Verdict:

Malicious

Labled as:

Stealer.Generic

Link:

https://www.hybrid-analysis.com/sample/d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-06-24T11:58:00Z UTC

Last seen:

2026-07-24T11:30:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ad055687-3c0f-46d3-9ea1-d318d04939c4

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/356da0ec0a8ee0dbbce0a40f84b960a9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef/

ReversingLabs TitaniumCloud Win64.Trojan.Remus

Threat name:

Win64.Trojan.Remus

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-26 10:09:46 UTC

File Type:

PE+ (Exe)

AV detection:

29 of 36 (80.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2m3ifojn33rl5gvy3ttr22kaz4lqqrlrvbu46ptm5prprjarg7xq._file

Threatray Remus

Verdict:

malicious

Label(s):

Remus

Alert

Create hunting rule

Link:

https://reports.threatray.com/fd4f05da-be0b-462f-b37f-410f6cba61bc

Similar samples:

171ff07d334a93105add23e6993e7efdf04010b42a31acae8d254472b1a2f6e5

RemusStealer

17502e8db2948738ef424ff4e5de9ffeaa7fea6777d0988540d32169cb7609ae

RemusStealer

4013ce45572f3c9c8606e037f34ab083867c32419865125601873e4b3aa477b6

RemusStealer

409ad0799fe0b1ca3265d58f95eb13b7d56d6bad1f7346459fb02f772a3bf751

RemusStealer

5095f5a21292e9ff05209199780e3c6627a90f00625565ec5267a78f11dde3a4

RemusStealer

6b70026b99b60a9bf104d6bd954a8a716c2038ac0074458bf190c61bab544cc8

RemusStealer

6c5157e20c93de46124ecd70d21b96c5ff86234adbf31e41c82769cd43119123

RemusStealer

8a6e25495bc52143928dfe6b31e52973884232e2a3d8024d0ae39dc96791b68b

RemusStealer

90a27fd7f19422c8b76ac2961c329b544ce06f1320c98295ab5fcaceff02d543

RemusStealer

9efb45d95c55a380fea16847c0b4560b0ff5355f422c1d6e52007ea13ac8d6a2

RemusStealer

d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef

RemusStealer

dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476

RemusStealer

Hatching Triage remus_stealer

Result

Malware family:

remus_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remus_stealer stealer

Link:

https://tria.ge/reports/260723-qsmw4axyby/

Malware Config

C2 Extraction:

http://hairkeratin.net:4959
http://carogra.biz:4219
http://myrtler.biz:9549

UnpacMe Remus

Unpacked files

SH256 hash:

d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef

MD5 hash:

356da0ec0a8ee0dbbce0a40f84b960a9

SHA1 hash:

f2eed6018f5e1bc8dbbf9145e6b24395e952ddc9

Detections:

Remus

Alert

Create hunting rule

Link:

https://www.unpac.me/results/67160de5-332b-4409-88df-bfcf2304f228/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/75805/