MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1
SHA3-384 hash: 530289a6688df3607c63c3c42ee3bd5ff674fe4008adcfc35db6f8ff1c6e7ceca01d47916cf6efcce0eabdd71ccc5110
SHA1 hash: 0ec9c0d2c4645776d630be30d41f60ea872dbd6a
MD5 hash: dbd4b9870f55d57cb57938df3834984d
humanhash: michigan-timing-victor-seven
File name:fix.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:2'605'536 bytes
First seen:2026-06-21 04:23:23 UTC
Last seen:2026-06-21 04:32:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f23ee6cae9102afbfd90f52d60f792d8 (1 x RemusStealer)
ssdeep 24576:NmDSiSZpXJTNQL0mDQSgJQ8V54Wu4/lNYZsaemESBeleDsaFYApw4lpSMJLUhZ:NmDTgpX1mLTDeJQuvNNgsTlHM16
TLSH T188C54947BE9148E6C0AAA2308972D2957B21FC442F2123D73AD0BF7A3EB6BD05D35754
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 9271e8d4ccccd0e8 (1 x RemusStealer)
Reporter kejult
Tags:exe Remus RemusStealer signed stealer

Code Signing Certificate

Organisation:Service State Formatter
Issuer:Service State Formatter
Algorithm:sha256WithRSAEncryption
Valid from:2026-06-20T15:25:01Z
Valid to:2029-06-20T15:35:00Z
Serial number: 797fe48eaab477b54c62ed6658c6ba7f
Thumbprint Algorithm:SHA256
Thumbprint: be5f480ad1686cb6e40f9897ef3670c52247a11e858570c269094a418e7af1d7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Kejult
Found on YouTube.

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Packed.zip
Verdict:
Malicious activity
Analysis date:
2026-06-21 04:20:21 UTC
Tags:
arch-exec stealer remus
Link:
https://app.any.run/tasks/f9f2ebed-b790-4fc0-9bc2-e063b60223ab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71401/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a378b8386bc95245bf82f3b
Tags:
injection obfusc virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Sending an HTTP POST request
Query of malicious DNS domain
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto fingerprint golang mingw obfuscated packed signed
Link:
https://www.filescan.io/uploads/6a378b3e9799578a6c4369d5/reports/d4afeaff-009b-455d-b710-811411212182/overview
Verdict:
Malicious
Labled as:
WinGo/Kryptik_AGeneric.BQ trojan
Link:
https://www.hybrid-analysis.com/sample/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1
Verdict:
Clean
File Type:
exe x64
First seen:
2026-06-20T18:31:00Z UTC
Last seen:
2026-06-22T23:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/069c9c1a-9369-479a-83c6-89e924102fdd
Score:
73%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/dbd4b9870f55d57cb57938df3834984d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1/
Verdict:
Malicious
Threat:
Family.REMUS_STEALER
Link:
https://tip.neiki.dev/file/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 05:25:00 UTC
File Type:
PE+ (Exe)
Extracted files:
7
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7n2wlutbdj3l26lkuq4osb62lofvtnnmy5klmay7k2myi2celpqq._file
Verdict:
malicious
Label(s):
remus
Create hunting rule
Similar samples:
error
RemusStealer
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:remus_stealer discovery spyware stealer
Link:
https://tria.ge/reports/260621-hp3t5sbz4j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: Remus
Malware Config
C2 Extraction:
http://none
http://carogra.biz:4219
http://myrtler.biz:9549
Unpacked files
SH256 hash:
fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1
MD5 hash:
dbd4b9870f55d57cb57938df3834984d
SHA1 hash:
0ec9c0d2c4645776d630be30d41f60ea872dbd6a
Link:
https://www.unpac.me/results/144b0d52-624c-40e4-bc9a-62681ba2ff05/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fb7565d2611a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.68
Link:
https://yomi.yoroi.company/submissions/fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1

(this sample)

anyrun
any.run
https://app.any.run/tasks/ca3d44c7-5b42-4953-882f-3adccfc1f2c4
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/71401/

Comments