Extracted

• • Target
    2026-05-28_c9ae264a73701dc399e96993c9555b52_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
  • Size 2.5MB
  • SHA256 9211735e9adb3d6777bdcff69e671583556fbd8ab500f7c7e5bb2c970fd24265
  • MD5 c9ae264a73701dc399e96993c9555b52
  • SHA1 a7b1cf9dbfb5083a8ca37fbe3faabd7154185a92
  • SHA512 7f18d5376cadb8fe59acae2a065266674398d8be16ef209688a4ce6c8b4ad94cca3cf66c249b47bac51e8072f0ce1ef38d04d7bd26a02bc439768b1c0a1981ab
  • SSDEEP 24576:YgfJn3AX9KV8HnRgKNnoOQ4y6s6yjQ6OgLP88WXj9/J0CD1j:5fB3AXoV8HRgmn7/5gLPfCD1j
  • TLSH
    T1D1C559477CC054BAD5AA923189B5A2E17732F8590F3167C33F11B6BA2E327D44E39398
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  e92213f4608be4e73f134eea0ae2eac0discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2