MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemusStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 4 File information Comments

SHA256 hash:	f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906
SHA3-384 hash:	f2c4f2f8b4ee0cd4e398184051dd1bb86bf92ce6ac65d2c6a7a0a7a6179ddc47c2cf6f392a326b45a82baa4075e02634
SHA1 hash:	c18fdfd1a053a9c408fb8ae563ea55684be5d4ab
MD5 hash:	79c3344864afd83d6cfa95aa816e3286
humanhash:	hotel-queen-illinois-freddie
File name:	file
Download:	download sample
Signature	RemusStealer Create hunting rule
File size:	174'592 bytes
First seen:	2026-06-26 12:16:14 UTC
Last seen:	2026-06-26 12:48:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	44fecc80f9b0222c9a3ac23b1cc2d9f2 (3 x Amadey, 2 x RemusStealer)
ssdeep	3072:GVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0k9qMaf5A:GVrRys/Lfg8ex1twMAOJ9pah
Threatray	4'015 similar samples on MalwareBazaar
TLSH	T1A2046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA
TrID	22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.7% (.EXE) Win32 Executable (generic) (4504/4/1) 7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	9d2ca3 dropped-by-amadey exe RemusStealer

Bitsight

url: http://91.92.242.236/files-129312398/files/file_3fec31ac90ffd33e.exe

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2026-06-26 11:56:06 UTC

Tags:

loader stealer stealc solaris payload

Link:

https://app.any.run/tasks/c12b12a6-a81b-482d-969e-833b43d04821

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72050/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3e6d9a86bc95245bf9a77c

Tags:

clipbanker btcware emotet spoof

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending an HTTP GET request

Creating a file in the %temp% directory

Searching for synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Connecting to a non-recommended domain

Sending an HTTP POST request

Launching a process

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Enabling the 'hidden' option for files in the %temp% directory

Creating a file

Creating a service

Loading a system driver

Creating a window

Changing a file

Query of malicious DNS domain

Creating a file in the mass storage device

Enabling autorun for a service

Blocking the Windows Defender launch

Blocking the Windows Security Center launch

Forced shutdown of a system process

Changing the Windows explorer settings to hide files extension

Enabling autorun by creating a file

Unauthorized injection to a system process

Enabling threat expansion on mass storage devices

Changing the hosts file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug downloader evasive evasive exploit explorer fingerprint lolbin microsoft_visual_cc mpcmdrun obfuscated reconnaissance update

Link:

https://www.filescan.io/uploads/6a3e6d916f6eb939a4f2a176/reports/e66240e3-9958-4794-898b-ce965d60a07a/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7cbcc7ef-2c3f-4277-b845-ccb2f8d91e7a

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906

Threat name:

Win32.Worm.AutoRun

Status:

Malicious

First seen:

2026-06-26 12:16:42 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 36 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6k2ptlbfwnjyskkk3y7472fixno4d4hcqpc34fc2fc6xqxuzheda._file

Verdict:

malicious

Label(s):

solarisloader

RemusStealer

2f25dcf66945cd695580f83afed2a76fbc0051ce64f1089e19b04c3cfdabeee4

RemusStealer

833e0e1e5d19915ef2f26a51fe20ae300e782911d6b374a0a295b0bf483ed718

RemusStealer

98632669b75fcc8e0e4f98eeeb20e0944ccf51f73d0c92b811354bd9e62f5212

RemusStealer

d13d3de76a86ab875c2acd0d28c866928c842b206d1f83eb3cc5886811fd24d2

RemusStealer

e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c

RemusStealer

error

RemusStealer

f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2

RemusStealer

+ 4'005 additional samples on MalwareBazaar

Result

Malware family:

remus_stealer

Score:

10/10

Tags:

family:remus_stealer defense_evasion discovery persistence spyware stealer

Link:

https://tria.ge/reports/260626-pflmtsa15x/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Downloads MZ/PE file

Sets service image path in registry

Detects Remus stealer

Family: Remus

Modifies visibility of file extensions in Explorer

Malware Config

C2 Extraction:

http://myrtler.biz:9549
http://carogra.biz:4219
http://youngel.biz:8768

Unpacked files

SH256 hash:

f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906

MD5 hash:

79c3344864afd83d6cfa95aa816e3286

SHA1 hash:

c18fdfd1a053a9c408fb8ae563ea55684be5d4ab

Link:

https://www.unpac.me/results/08937106-2b72-47be-8197-350f60de82ee/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f2b4f9ac25b3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.