> Family · remusstealer_

~/packetpursuit $ cat /intel/families/remusstealer.md

typeentityconfidencemediumcreated2026-06-17updated2026-06-17malware-familyinfostealerpackerobfuscationevasion

remusstealer

Confidence: medium. OpenCTI labels this family, but the only analysed sample so far is a Protector Lab-packed stub with no recoverable stealer strings in the outer binary. Attribution rests on the decrypted payload, which is not available statically.

Overview

remusstealer is a label applied by OpenCTI / MalwareBazaar to PE32+ x64 binaries packed with the commercial Protector Lab (plab) toolchain. The outer stub decrypts an AES-256-GCM payload overlay at runtime. The actual stealer logic is completely concealed until dynamic execution or successful payload extraction.

Build Stack

  • Toolchain: MinGW-w64 GCC 15.2.0, LLD 18.1.8, GNU C23 ^[sample 2b2293a0/strings.txt:2585]
  • Packer: protector-lab-overlay — AES-256-GCM encrypted overlay with build-seed key derivation ^[sample 2b2293a0/strings.txt:1688]
  • Signing: Unsigned
  • Obfuscation: Configurable anti-debug + polymorphism levels via JSON manifest

Deploy / TTPs

ATT&CK ID Technique Evidence
T1027.002 Obfuscated Files or Information: Software Packing Protector Lab overlay ^[sample 2b2293a0/strings.txt:1755]
T1055 Process Injection Child process manipulation imports (VirtualAllocEx, WriteProcessMemory, ResumeThread) ^[rabin2-info.txt]
T1106 Native API Dynamic resolution of NtQueryInformationProcess, NtQuerySystemInformation ^[sample 2b2293a0/strings.txt:4557]
T1497 Virtualization/Sandbox Evasion PEB debug indicators, hardware breakpoint checks, instrumentation module scan ^[sample 2b2293a0/strings.txt:4565-4569]

Capabilities

  • protector-lab-aes-gcm-overlay
  • runtime-api-resolution-ntdll
  • anti-debug-multi-level
  • anti-vm-peb-indicators
  • process-injection-child-hollow
  • polymorphic-build-seed

Variants / Aliases

  • OpenCTI: remusstealer
  • Packer branding: plab, protector-lab, PLABOV21

Notable Analyses

  • 2b2293a0 — May 2026 MinGW-w64 x64 packed stub, 3.1 MB, no C2 strings in outer binary. Report: /intel/analyses/2b2293a0cd9ff8648a95a9a46e6999c9e9961fc281ff5d0b698a22755974c621.html

Related