SUSPICIOUS — 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69.bin

SUSPICIOUS — 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100), attributed to the Remus family. 4 of 55 detection engines flagged it.

Identification

SHA-256: 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69
SHA-1: 6029236672c2e749e634ad10d8ecf1fff290095b
MD5: 3630a824324aa896c9cc0485c9c74f82
imphash: 5b42a4245cc2420314fc2caf4bbdc71f
ssdeep: 3072:dtDPL086KvAq6wHgG08mEthZs6siURap6lYa/:Pz08pYq5tlthZseo
TLSH: T1C7430920A15633F0E1FBF430B020998E903BB061A174BDDD590FCA1D5295ABB93F5DA6
Submitted as: 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69.bin
File type: pe · Size: 228864 bytes
Verdict: suspicious (67/100) · Family: Remus

Source: MalShare · first seen 2026-08-19T22:04:47.732Z · SHA-256 verified

Detections (4 of 55 engines)

Microsoft Defender: Trojan:Win32/Lazy.RR!MTB
Emsisoft (Emergency Kit): Gen:Variant.Stealer.535
Trellix Stinger (McAfee): Remus!3630A824324A
Kaspersky (KVRT): Trojan.Win32.Agent.gen

Why this verdict

The suspicious score of 67/100 is the fusion of 2 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_bf05250c5a (pid 4976) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 20 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

10 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782049&P2=404&P3=2&P4=bauWxSS5cWA44XNCnbBzb8hzm5UVAxMGxx8vLkz3W%2bAFo6Yr7TM2Ijy607NxzWP0%2bKlaAQy3RBtOcywzKSAMrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782098&P2=404&P3=2&P4=P1LkwX%2fC0oebHpl3KKE7Zi9Wy9PB6RKXkLfIxCOq1%2f4cdKxSz%2bMHdbT5x1qHy24W5JJzHPEDYZ1ne6h%2fvrfgUA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787178873&P2=404&P3=2&P4=AKMEgRbXQL7MhAP233YDumyo7z2ueZh6naaqJTxJQNQFLO6R7dbDM3uxfbFh2iTGutVR3i1GhYOFESezsjXMGA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787178331&P2=404&P3=2&P4=dunEDwZdkWY8b%2b7UBPW2Vz3gMWKuyUZF4NR40NLqV%2bfMAeuAGyb5BcnFrMPKLuR7OxTNayo2wEnqly7HYap3ZQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.111
4.230.171.124
4.247.188.233
20.247.184.142
135.233.95.144
20.165.94.54
52.168.117.170
52.123.128.14
20.231.239.246
74.178.76.44
203.26.79.13
135.234.160.244
52.148.114.188
72.145.35.104
52.168.112.67
172.170.180.133
40.74.98.198
4.150.223.107
4.150.223.115
52.110.12.55

More Remus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report