MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9
SHA3-384 hash:	47a7132a8ac1118907ff419b097183f8d1670505ade01869b7a86654a9d002e8b9706bf19a48af25342fbc8e58dedb7f
SHA1 hash:	0ac6bab3da3917154b1bef0c728ebccda3f35bfc
MD5 hash:	84e440ec3c47a4ecf3ab2431c354283c
humanhash:	december-twenty-avocado-pennsylvania
File name:	e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9.exe
Download:	download sample
Signature	RemusStealer Alert Create hunting rule
File size:	230'912 bytes
First seen:	2026-09-18 14:26:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	754318d99f6bf9d00342a1a491eb8242 (5 x RemusStealer)
ssdeep	3072:svaKrrR0udjN1z0v34OTmMMaj0aFfeqrxudGTYNbA7mqDs9GnP346DV:svaQrM82BRxdYZGnP346
TLSH	T12A343B6BD25331FCD552C078A26A7222B771B53C87349EF703A2C3319E21AC06E79A75
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	whack_sh
Tags:	exe RemusStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

152

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-18 14:31:47 UTC

Tags:

generic loader etherhiding

Link:

https://app.any.run/tasks/9ce8a33e-3da5-4923-89f9-65a8ec245517

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Remus

Detection:

Remus

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/86638/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.PWS.Remus.32.28215.28312.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context fingerprint packed

Link:

https://www.filescan.io/uploads/6aad4a4f164ad31639ebbcb5/reports/a3b3986e-98b8-4806-a727-e24cc304571d/overview

Hybrid Analysis Stealer.Generic

Verdict:

Malicious

Labled as:

Stealer.Generic

Link:

https://www.hybrid-analysis.com/sample/e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-17T18:48:00Z UTC

Last seen:

2026-09-19T18:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/54159383-9ef8-4f12-9b2a-c43e2b44257b

Joe Sandbox REMUS Stealer

Result

Threat name:

REMUS Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1974856

Signature

Multi AV Scanner detection for submitted file

Yara detected REMUS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/84e440ec3c47a4ecf3ab2431c354283c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9/

ReversingLabs TitaniumCloud Win64.Trojan.Remus

Threat name:

Win64.Trojan.Remus

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-18 00:34:24 UTC

File Type:

PE+ (Exe)

AV detection:

26 of 38 (68.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4psrdblfkddvat33yvv2k22g6ghzwqpp5dm34ou2xokx5i5z26uq._file

Threatray Remus

Verdict:

malicious

Label(s):

Remus

Alert

Create hunting rule

Link:

https://reports.threatray.com/03280566-7681-4023-98a1-646cd59d8934

Hatching Triage remus_stealer

Result

Malware family:

remus_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remus_stealer stealer

Link:

https://tria.ge/reports/260918-rskx6sxw5p/

Malware Config

C2 Extraction:

http://shhsift.click:7647/reviews
http://fresok.top:9048/accounts
http://vexdico.shop:8539/tags

UnpacMe Remus

Unpacked files

SH256 hash:

e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9

MD5 hash:

84e440ec3c47a4ecf3ab2431c354283c

SHA1 hash:

0ac6bab3da3917154b1bef0c728ebccda3f35bfc

Detections:

Remus

Alert

Create hunting rule

Link:

https://www.unpac.me/results/80ca1709-2e20-4dcd-800f-37fb55a9a736/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

exe e3e511856550c7504f7bc56ba56b46f18f9b41efe8d9be3a9abb957ea3b9d7a9

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/86638/