Extracted

• • Target
    2026-07-03_81b68f3421e9ca93f2b27fcb3ec6931f_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.1MB
  • SHA256 3e050df062c9235b6e21e866a29527a8948a725ca10a520787e6d72b964dcb85
  • MD5 81b68f3421e9ca93f2b27fcb3ec6931f
  • SHA1 11ca88929b6a8a0a9b0b063c467212f396376179
  • SHA512 f6f7d0793657e0b8395f06bfef89b25518f2ca0ca8e9c8f87c8f093f54100c7da64bb6459251a2a2c32673440182f37570bbdaf9d595358e64f44e919f63c118
  • SSDEEP 24576:Z5CqaVWYhTgaTtrzpl9qJA5v7XKU2yj/x6GotSFRoFtxzBele5rK2mM4VLHO:Z5CtVWGTVNzH9bj6Got5/4e
  • TLSH
    T1ACA55B0B7CE009E9C4AA673689B651927B74BC490F3223D72E90B7782F727E09D75784
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistenceransomware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2