🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476
SHA3-384 hash: 71801e797117f587c059977f056d505f4db1f3f078d322eaf0f7d75770e52f13ef437469b5fcd4a3138cf585a1096b22
SHA1 hash: 51a7a31c906c3db9907db443e8f1de66a5c6f253
MD5 hash: c0c9598bbdb6ff64c6f17e66caaec067
humanhash: saturn-fix-gee-edward
File name:dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476.ps1
Download: download sample
Signature RemusStealer
Create hunting rule
File size:11'530 bytes
First seen:2026-07-23 13:29:30 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 192:jkxVWnfrr+Fs/T9vQFRoZ1ZCMFm5HOpp4pW89Rrun0dxEzFu5CVPgCm:4xVWnfrKa/T9oFRoZDbFm5HOpp4pW891
TLSH T1DA3212412BEB0244F2F77E496ABF48580A777A559E32CA4D819D184E0FF3E10D869F72
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika powershell
Reporter JAMESWT_WT
Tags:hairkeratin-net ps1 RemusStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Script.SNH-gen.84196296.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
downloader
Link:
https://www.filescan.io/uploads/6a62175af257cf73b82ea4a1/reports/ec127988-69ae-455a-9297-2a29ed8e16d8/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476
Verdict:
Malicious
File Type:
ps1
First seen:
2026-06-21T10:44:00Z UTC
Last seen:
2026-06-21T10:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476/results?tab=lookup
Score:
76%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
PowerShell T1059.001 T1105
Link:
https://app.malva.re/file/c0c9598bbdb6ff64c6f17e66caaec067
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476/
Threat name:
Script-PowerShell.Trojan.NetLoader
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 11:58:00 UTC
File Type:
Text (PowerShell)
AV detection:
11 of 36 (30.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=374pnwlyi4a7mtebz3h24gegwr2ryhmhxfc274tniqrjqkzqyr3a._file
Verdict:
malicious
Label(s):
Remus
Create hunting rule
Link:
https://reports.threatray.com/9b2dbe42-f20b-48bf-bd09-8b7805f30e0b
Similar samples:
171ff07d334a93105add23e6993e7efdf04010b42a31acae8d254472b1a2f6e5
RemusStealer
17502e8db2948738ef424ff4e5de9ffeaa7fea6777d0988540d32169cb7609ae
RemusStealer
36637ad6c4db081520b7811c5daf8fd63389c21f273884bceeb7aed1280ffdfc
RemusStealer
4013ce45572f3c9c8606e037f34ab083867c32419865125601873e4b3aa477b6
RemusStealer
5095f5a21292e9ff05209199780e3c6627a90f00625565ec5267a78f11dde3a4
RemusStealer
6b70026b99b60a9bf104d6bd954a8a716c2038ac0074458bf190c61bab544cc8
RemusStealer
6c5157e20c93de46124ecd70d21b96c5ff86234adbf31e41c82769cd43119123
RemusStealer
8a6e25495bc52143928dfe6b31e52973884232e2a3d8024d0ae39dc96791b68b
RemusStealer
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:remus_stealer execution stealer
Link:
https://tria.ge/reports/260723-qsqmzsxycs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Detects Remus stealer
Family: Remus
Malware Config
C2 Extraction:
http://hairkeratin.net:4959
http://myrtler.biz:9549
http://carogra.biz:4219
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments