Extracted

• • Target
    2026-06-25_552fe73ee398095f3df69b93b77d512b_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.2MB
  • SHA256 29500abca9328a32c0e8ff42b5050df89cca7dd3459e329bb95c2fb4638de133
  • MD5 552fe73ee398095f3df69b93b77d512b
  • SHA1 8479116db60bf8eec8b4a65c94c10e6ae267946e
  • SHA512 d75b15353d3737bdc37afda728e1a6839edfa5470589b6b072b729ad50d98074d1585c10ef77b788f846c74f135147c2772ee27907563171116c9a461b54a26f
  • SSDEEP 24576:DnqJbrJoC6P2vh12JDWS+p11hITKOEfB4X/ibg3/txJBele5r92mMNtCmBWiSo:DnqNlox2J12JSjpf5GQeVdij
  • TLSH
    T19BA56C077CE048E9C4A9533188B662927B75BC050F3267D72E90B7782FB6BE19D36784
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2