Researchers Link Remus 64-Bit Infostealer to Lumma Stealer
Summary
Gen Threat Labs attributes the 64-bit Remus infostealer to Lumma based on shared code and techniques, including an Application-Bound Encryption bypass. The analysis details Remus’s EtherHiding C2 resolution and added anti-analysis checks.
Key points
- Gen Threat Labs assesses Remus and transitional test builds called Tenzor as Lumma variants, citing shared string obfuscation, syscall handling, control-flow obfuscation and code patterns.
- The researchers say Tenzor samples date to September 2025 and Remus appeared in campaigns around January–February 2026.
- Remus and Lumma use a similar Application-Bound Encryption bypass: injecting shellcode into browser processes to decrypt the v20_master_key in memory.
- Remus retrieves C2 information through Ethereum smart-contract calls using EtherHiding, replacing Lumma’s Steam or Telegram dead-drop resolvers.
- Remus adds checks for sandbox-related DLLs and a honeypot PST file, and performs AntiVM checks.
- The analysis says Remus can steal browser passwords, cookies and cryptocurrency; it also describes clipboard collection and other shared capabilities.
Article Details
- Attack Vectors
- Gen Threat Labs attributes the 64-bit infostealer Remus to the Lumma Stealer family; the article reports Remus campaigns beginning around February 2026.
- Remus and Lumma Stealer steal browser-stored passwords and cookies; the article also describes cryptocurrency theft.
- To bypass Chromium Application-Bound Encryption, Remus injects short shellcode into a browser process, locates the in-memory v20_master_key, and calls CryptUnprotectMemory in that process. SYSTEM token impersonation is described as an alternative bypass.
- Both Remus and Lumma collect clipboard contents, convert them from UTF-16 to UTF-8, and append them to an exfiltration archive.
- Remus uses an Ethereum smart-contract dead drop: it sends an eth_call JSON-RPC request over HTTP to a public RPC endpoint and extracts a C2 URL from the response.
- Anti-analysis checks include CPUID-based hypervisor detection, checks for sandbox-related DLLs, and a search for [email protected]; the article says Remus exits silently if either of its additional checks fails.
- The malware uses string and indirect control-flow obfuscation, and Remus and Lumma use direct syscall or sysenter handling.
- Defensive Notes
- The report provides a non-exhaustive set of Remus C2 IP addresses and domains, plus SHA-256 hashes for Remus and Tenzor samples; it says a complete IOC list is available on GitHub.
- Behavioral detection opportunities described in the report include browser-process shellcode injection followed by CryptUnprotectMemory use, and HTTP JSON-RPC requests used to resolve C2 addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | adveryx[.]biz | Domain listed as Remus C2 infrastructure. |
| DOMAIN | baxe[.]pics | Domain listed as Remus C2 infrastructure. |
| DOMAIN | buccstanor[.]pics | Domain listed as Remus C2 infrastructure. |
| DOMAIN | chalx[.]live | Domain listed as Remus C2 infrastructure. |
| DOMAIN | drymoge[.]biz | Domain listed as Remus C2 infrastructure. |
| DOMAIN | gluckcreek[.]online | Domain listed as Remus C2 infrastructure. |
| DOMAIN | intem[.]lat | Domain listed as Remus C2 infrastructure. |
| DOMAIN | krondez[.]com | Domain listed as Remus C2 infrastructure. |
| DOMAIN | nobleckly[.]biz | Domain listed as Remus C2 infrastructure. |
| DOMAIN | parky[.]pics | Domain listed as Remus C2 infrastructure. |
| DOMAIN | texakgi[.]cloud | Domain listed as Remus C2 infrastructure. |
| IPV4 | 217[.]156[.]122[.]12 | C2 server IP listed in the Remus indicators. |
| IPV4 | 217[.]156[.]122[.]57 | C2 server IP listed in the Remus indicators. |
| IPV4 | 217[.]156[.]122[.]75 | C2 server IP listed in the Remus indicators. |
| IPV4 | 45[.]151[.]106[.]110 | C2 server IP listed in the Remus indicators. |
| IPV4 | 80[.]97[.]160[.]155 | C2 server IP listed in the Remus indicators. |
| IPV4 | 86[.]107[.]168[.]103 | C2 server IP listed in the Remus indicators. |
| IPV4 | 94[.]231[.]205[.]229 | C2 server IP listed in the Remus indicators. |
| SHA256 | 0580ebf601989457f0708799b431fd4d9f5e59d98838282d72936099aa6636da | SHA-256 hash of a Tenzor test-build sample that Gen Threat Labs tracks as a Lumma Stealer variant. |
| SHA256 | 0a8f734f10400f7ae8fef591147e78dab6350089683be84c1cb6c82113cb1319 | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | 25e74a76f2f3601abcb20fd743a7e3cf3befd5a3838c7501af5d87d293233809 | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | 4428c3ffe2532f162f31d7573bbc1cca2299195421da3d8e8a3e535e9fc42b08 | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | 484e3ab5d425a97819f01dcc330e005dc444c51625bfdcd7ea9a3954018d1fc9 | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69 | SHA-256 hash of a Remus sample used as a technical-analysis reference. |
| SHA256 | 788b56e9be2f1dd6a977dce0265f293ab42d3e8ffb287ab584e169fbf115da1f | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | 7a25253e6d8d9ccf62a67f8014cacb301daf9e40f1b68ecc7f354d6896d16960 | SHA-256 hash of a Tenzor test-build sample listed in the report. |
| SHA256 | 8653d7158486aa10fc0078c3ca9318cd7ace05d4b3e6f3b1fb84ffb7a6a339ec | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | a4f111e5425690fcd384c62ecb5b57b0f645925572af3541748e01d810cd2b40 | SHA-256 hash of a Remus sample listed in the report. |
| SHA256 | cab7855ccfca19a06eea76e0e170f592dcc95906ecfa5436f5a11947e04e63d5 | SHA-256 hash of a Tenzor test-build sample listed in the report. |
| URL | hxxps[:]//steamcommunity[.]com/profiles/76561199861614181 | Specific Steam profile URL identified as a Lumma/Tenzor dead-drop resolver used to retrieve C2 information. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationRemus and Lumma use obfuscated strings and indirect control-flow dispatch to hinder analysis.T1055 · Process InjectionRemus injects short shellcode into browser processes to decrypt the in-memory v20_master_key; Lumma is described as using a similar approach.T1071.001 · Web ProtocolsRemus sends HTTP JSON-RPC eth_call requests to a public RPC endpoint to retrieve C2 information from an Ethereum smart contract.T1106 · Native APIRemus and Lumma build syscall lookup tables and use direct syscall or sysenter dispatch to invoke native functions.T1115 · Clipboard DataBoth families read clipboard contents, convert them to UTF-8, and append them to an exfiltration archive.T1134.001 · Token Impersonation/TheftRemus and Lumma use SYSTEM token impersonation as an alternative method for bypassing Application-Bound Encryption.T1497.001 · System ChecksBoth families use CPUID hypervisor-vendor checks to detect virtualized analysis environments.T1539 · Steal Web Session CookieThe article reports that Remus and Lumma steal browser cookies.T1555.003 · Credentials from Web BrowsersRemus and Lumma target browser-stored passwords and the browser master key.
Malware
Lumma StealerGen Threat Labs attributes a new x64 infostealer called Remus to the Lumma Stealer family, presenting multiple lines of evidence including identical string obfuscation, AntiVM checks, direct syscalls, indirectRemusGen Threat Labs attributes a new x64 infostealer called Remus to the Lumma Stealer family, presenting multiple lines of evidence including identical string obfuscation, AntiVM checks, direct syscalls, indirectTenzorRemus evolves Lumma’s design with 64-bit builds, EtherHiding (Ethereum smart-contract) dead-drop C2 resolution, new anti-analysis checks, and test builds named Tenzor that link the two families;
Products
Chromiuma different key than the one used to protect the key on disk – it is a separate protection layer that Chromium browsers use to safeguard the key while it resides in memory at runtime.EthereumRemus evolves Lumma’s design with 64-bit builds, EtherHiding (Ethereum smart-contract) dead-drop C2 resolution, new anti-analysis checks, and test builds named Tenzor that link the two families;Google ChromeIt begins by walking the browser’s PEB module list, looking for two modules in a single pass: dpapi.dll and the browser DLL (e.g., chrome.dll).SteamRemus replaces Lumma’s Steam/Telegram dead-drop resolvers with EtherHiding (Ethereum smart-contract calls via eth_call JSON-RPC) to retrieve C2s, making takedown harder.TelegramRemus replaces Lumma’s Steam/Telegram dead-drop resolvers with EtherHiding (Ethereum smart-contract calls via eth_call JSON-RPC) to retrieve C2s, making takedown harder.