Extracted

• • Target
    2026-07-05_8ff8509c63c8dcfb5349a7691c0d7363_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.1MB
  • SHA256 0350de7cdac919529ec58d085ae1eb7ece2bafba425593fbcedb7826a84ee713
  • MD5 8ff8509c63c8dcfb5349a7691c0d7363
  • SHA1 dae33edb4229db54bab5a44da6a2e71c02f9fd48
  • SHA512 01eaf852666e22ad3030fec9ee487d7640bb0ffab5c607aa15c814cff051aeb1a93258848eadf94487988d91eeaf4c0c5801892408646340f6e9313171d697fe
  • SSDEEP 24576:jtOwZW+KYk0lS7+XY5zGPYDKWlYq4e00GLA92mmJtxwBele5rK22DN3Znk37V:jtxYTY7e+IxEcznWLXs8b2
  • TLSH
    T14FA56B0B6CD049E9C8AA973288B652917B35BC454F3237D72E90B7783EB27D19D36780
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistenceransomware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2