MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148
SHA3-384 hash:	3322013e8ebecedeb5ab5ba4916d50e406ec366c3cbaac4b29bc8e54f95d25744f0e81f7f0ac8bffb5e06c62a11284fb
SHA1 hash:	ffbb27bfb6d57261e985704b7cf77f304840187c
MD5 hash:	e71d840514e1411cc2894c027e7cca81
humanhash:	sink-coffee-enemy-fruit
File name:	SurgeMenu.exe
Download:	download sample
Signature	RemusStealer Alert Create hunting rule
File size:	3'420'672 bytes
First seen:	2026-08-11 14:10:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef4b03625c91bc1e117085b53de00fc9 (1 x RemusStealer)
ssdeep	98304:TqinOMWAQbrtUCTVBjYphAJO/U74wTcRDHqT:GiOM3OKC3obo4woRDKT
TLSH	T1CFF53303A3D9C205C3739D386ABBD1931CB6FCD66F25CADE5284960C16715A086EC7BB
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	e08e616565618ee8 (1 x RemusStealer)
Reporter	kejult
Tags:	exe Remus RemusStealer stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

137

Origin country :

DE

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/dbe4a321-41d8-4a16-b5b4-16a2e3a6ef2c/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

SurgeMenu.exe

Verdict:

Malicious activity

Analysis date:

2026-08-02 03:50:12 UTC

Tags:

stealer remus

Link:

https://app.any.run/tasks/93b5be95-2538-4e44-b9c6-43b10693c363

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Remus

Detection:

Remus

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/80335/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.54446644.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Launching a service

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

installer-heuristic packed

Link:

https://www.filescan.io/uploads/6a7b2e39e90b1a020ea8c6db/reports/88ef432e-2714-4100-a7ad-4841850fc04f/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-01T11:32:00Z UTC

Last seen:

2026-08-09T13:52:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148/results?tab=lookup

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/827f5895-9308-4d19-a622-153e2d1a1ab4

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148/

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-01 23:16:41 UTC

AV detection:

15 of 24 (62.50%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ajpl2c62x2w5qnsluf3qxi37qzbjasthktss7g74bdy6pksqfea._file

Threatray Remus

Verdict:

malicious

Label(s):

Remus

Alert

Create hunting rule

Link:

https://reports.threatray.com/569776ca-70c0-43c8-bec8-f150f161e7c0

Hatching Triage remus_stealer

Result

Malware family:

remus_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remus_stealer discovery spyware stealer

Link:

https://tria.ge/reports/260811-rjwy3sfp3t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: Remus

Malware Config

C2 Extraction:

http://primzes.biz:8528
http://zelpx.garden:9895
http://fimmora.surf:6504

UnpacMe

Unpacked files

SH256 hash:

d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148

MD5 hash:

e71d840514e1411cc2894c027e7cca81

SHA1 hash:

ffbb27bfb6d57261e985704b7cf77f304840187c

Link:

https://www.unpac.me/results/7ece83c0-c8f7-4a9b-8e5e-37e07977895e/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d812f5e85ed5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

exe d812f5e85ed5f56ec1b25d0bb85d1bfc321482533aa7297cdfe0478f3d528148

(this sample)

any.run

https://app.any.run/tasks/93b5be95-2538-4e44-b9c6-43b10693c363

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/80335/