MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0
SHA3-384 hash: 8b7b29230d33a071df84a9ea8a376dec319c87a92ce089bb4830388a58d35c991b85131c010c2ffa8cc383797afbb3d7
SHA1 hash: 909881eeb554e63f5c01009682a66b86e2bccac1
MD5 hash: f23a46170f50a0a300ee75f32dcb48f8
humanhash: fanta-harry-skylark-pizza
File name:file
Download: download sample
Signature RemusStealer
Create hunting rule
File size:6'634'496 bytes
First seen:2026-07-01 03:32:59 UTC
Last seen:2026-07-01 05:42:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:OA2/PRUj4FOEQSOaYXXpDYALLRENU9Qd+buk1eHxjCJdJdUNAuqeVIpLdcQeBQAc:3eikYJAYXWU9w6ZcHEffv
TLSH T163665AC367F91732E6AE0F79ACBC45110A71BD06BE2DE60E1945B4AB8977340B903367
TrID 38.2% (.EXE) Win64 Executable (generic) (6522/11/2)
26.4% (.EXE) Win32 Executable (generic) (4504/4/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.7% (.EXE) Generic Win/DOS Executable (2002/3)
11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 4cb26964b0cc45ba (3 x Rhadamanthys, 1 x RaccoonStealer, 1 x LummaStealer)
Reporter Bitsight
Tags:dropped-by-gcleaner exe G RemusStealer US0.file


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
2
# of downloads :
230
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0.exe
Verdict:
No threats detected
Analysis date:
2026-07-01 03:34:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/49e8e7a2-9f3f-4af4-aa02-105ee79b693a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72543/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a448a907ebb079b692b3e8e
Tags:
dropper micro hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending an HTTP POST request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 evasive fingerprint installer-heuristic lolbin msiexec overlay packed packed privilege reconnaissance regasm stealer
Link:
https://www.filescan.io/uploads/6a448a8a3d7c5f66c2eb040a/reports/ed3ea09a-d5a6-4106-9162-a33bb72dc005/overview
Verdict:
Malicious
Labled as:
Stealer.Generic
Link:
https://www.hybrid-analysis.com/sample/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-01T00:42:00Z UTC
Last seen:
2026-07-02T20:12:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan.Win32.Injuke.ptgh
Link:
https://opentip.kaspersky.com/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/eaca6f1d-e098-4df1-a0f7-6636dc67b902
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0/
Verdict:
Malicious
Threat:
Family.REMUS_STEALER
Link:
https://tip.neiki.dev/file/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0
Threat name:
Win64.Trojan.Remus
Create hunting rule
Status:
Malicious
First seen:
2026-07-01 03:33:37 UTC
File Type:
PE+ (Exe)
Extracted files:
309
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5sejuspl2wwwnqcjt66g7pdainr4qjnl3szbnf4nimfeb5p35lia._file
Verdict:
malicious
Label(s):
remus
Create hunting rule
Similar samples:
error
RemusStealer
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:remus_stealer adware persistence ransomware spyware stealer
Link:
https://tria.ge/reports/260701-d4e96sdw9l/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates connected drives
Boot or Logon Autostart Execution: Active Setup
Family: Remus
Malware Config
C2 Extraction:
http://myrtler.biz:9549
http://carogra.biz:4219
http://youngel.biz:8768
Unpacked files
SH256 hash:
ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0
MD5 hash:
f23a46170f50a0a300ee75f32dcb48f8
SHA1 hash:
909881eeb554e63f5c01009682a66b86e2bccac1
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
fe63fa41a611428ad3be2e434efb0b953c40ac2f99b34e25e758f495e1eaf69c
MD5 hash:
f5c86c04ac725a447506fa01dfba1050
SHA1 hash:
0b7da98cfb6db3f9443f3c16bddb2c0d3ea3e293
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
e1d0b412d96135040a3e11d56f8b77b470d60dde340edc3152b089ec9f87befa
MD5 hash:
3b6b3bdacdcbb52810c1fbd5eda3ba5a
SHA1 hash:
7d000ea25a9eec7a7accad15ad07443d39f3995e
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
d4f08d4f434ecb9063f25b5b19d5e33941c2940061fd15bb3edaf873269772ec
MD5 hash:
b9ff501f1e784053f14e473cd761798d
SHA1 hash:
bd3005df22ecda611151e3befc14ba141fb215a6
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
c93b5102ce5dfeecc8f08578b54b696b048af428936a6ae160b0bbbd21abaaf0
MD5 hash:
6bb71304dce8de5b10e9d5ff8a9452d3
SHA1 hash:
04173a61d6ddde77939c96fc23ed919bed460157
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
4cf62f5097b57e56d7709f0c25ac6d677fa880a9d1415a181726b0b1ef201ecb
MD5 hash:
c0cc0427bd955004bb750e1a879f2449
SHA1 hash:
efdac3cd67e6418c3510419051f86e517a554b88
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
53744d3019e042a9426ccbf1fa2b342d7478949e484b1f5058d6ebe7ec2b275d
MD5 hash:
e7676a2acacaa8a5b3ed1d617978b6da
SHA1 hash:
8da6642a7240dbf2cb26d994fbd51158431d6d95
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
b723844977f88faac8fac72c963b17e4119c642e11cc419047293fe3a580a430
MD5 hash:
5c7210bac73e9c8617193592efecaa86
SHA1 hash:
f9b85de267fe4e0f00190e9646dcc14d4ada7999
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
d7ec72b23e4d8e21b962627bdb6c6c3fc8c12cee0fd261425af101bbdb309c4c
MD5 hash:
2d5e4bba4240d6bec70cb7cb0d037e02
SHA1 hash:
a2f745a8c16899320bae6fbdd59c72f01779110e
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
b7e7531572ffff0f70701c01f74495f17da66c69339da2432b00d75f5dd02b1a
MD5 hash:
cbae59c56f2549ec88341ce82625d20c
SHA1 hash:
8fc76b928800613569bfb05a2fe5fc081baff59d
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
a191ffe734de28c36412d47d8ba8726dff65617611345aaab807003b214c310d
MD5 hash:
d129d5347edcbd34d38e89e048965d61
SHA1 hash:
1ee7ffadeb56aedd9473c8e6fa3a128e87fbf91e
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
a4f8a6c0212c676dc74bed7ae8257d9e5161968ebdd9e0c32a380d0398f1478a
MD5 hash:
80fa3b421bc877081ae6f721b8f9b915
SHA1 hash:
a2b9310c95cd95be2538d5f53cc1fe344a9dd7a4
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
1329dc8b3755018b843b6db1c04f82c6875ce7f7639b48d4f9270e8fd4bcd6c9
MD5 hash:
19044cd196b5d65af605623732f532a1
SHA1 hash:
4ca4ef540f7feada268a53a68d0f5f89652ad645
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
aad099dd7c1504e6fbd03b33af468dacd0644f3644ac74b64925720ab26c3b04
MD5 hash:
689721aec6c0f5eab7c728c6b00e119f
SHA1 hash:
d74e4f6af8ec8a528a745acaed5623d1baf12ddb
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
1f083cb0d26b3595e43c1e1fcde94d499ac5ddda3e013c630916aa3c632c8b46
MD5 hash:
1a392cf36845c8096fa6309ecb01bb8d
SHA1 hash:
89fe50af2dc10258de74e54b67e42bdd4c95719b
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
2f342dd5c5dbde8adc1e8ab4a84f33e584ff795dd8436b09d12d6a550bff8588
MD5 hash:
f854153ff6f42879df87b1202658314f
SHA1 hash:
3179948afd70a650b4a9821bf0fc33ccaa2c7bda
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
77efff8b115080cce24a104c50a79f0e3af1ab1ec0aa6b9a8c9cd137c91ca828
MD5 hash:
b5e55efd1106bc66c97dbb31fc7c1487
SHA1 hash:
2338ba35f704f442cb998d0c72afa83390477af7
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
2dcf9c5b9133fce022d8c1d46048e53c2fd8485b8b7115592bfe46b6b83839d7
MD5 hash:
0fe8deb89a1bbd5601cd8f3f90c537fe
SHA1 hash:
03b36d6cf41ba5b8222bcc7944aa35826804de24
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
ac15806bbb17fba29f2a014c8dd91e20b31d5b3275a019f9c926d7ebb4c23c9b
MD5 hash:
35b37699a3fa6e95274e8d5d4778f8e5
SHA1 hash:
d9338b77a9f8de6a1c7bfd7a78b277225d51741c
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
523d32d1dde1f13afbffcd83b20749bbdeeb116d3aab9ed34f085fe0518b0c44
MD5 hash:
a443a4e7fc8a1e804e01af587f9b1346
SHA1 hash:
d750db743b8f1f218a86dad0081f81a291ae0917
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
87302e40d2da7b0421a275cc187f83fd05357bb509395c5dd0ebf8514bfc91f9
MD5 hash:
eb06d5a24684ed49301f0620b2a853d9
SHA1 hash:
a59f68efa1d7d8ecbd70c3c9803089b0f30b4d2f
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
f22bc59657c40e9b28d5c7b92846220149522c86867b7af0832f07ffb88bf90f
MD5 hash:
3bb66d4cf9c250ea05fb163fb5962128
SHA1 hash:
acbd661c9d4fa0ef9356394caed285fb6134cc1a
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
06b4175587a784b71094638f42fe405c513ef58a38d47097ac73bdf6b9e9d7d7
MD5 hash:
166cbd342691d04b4dd46e2c5c7132e7
SHA1 hash:
7683b3e4ab48e1cf0d1c6c065cc97d99c640b8a6
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
SH256 hash:
4ec52ffbd541b7bea21bdb8c69257aa6479cd7641ca9ee228771ca32252dac07
MD5 hash:
0ccd98e448d742d70f60d94db2883d62
SHA1 hash:
261df8d5a95ff61bd6fea8749dec21e7a77a33c2
Link:
https://www.unpac.me/results/6a6a643e-01d4-453d-b19b-a2869a1218a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:test_rule_vldslv
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe ec889a49ebd5ad66c0499fbc6fbc604363c825abdcb216978d430a40f5fbead0

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/72543/

Comments