Extracted

• • Target
    2026-07-06_505e7c5cc6dfb38ae1235d19f5be4581_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 122.1MB
  • SHA256 8b382978d7a42fa8296068c24c4df7edf099d073d6d8650c517d8c8476f6a2d9
  • MD5 505e7c5cc6dfb38ae1235d19f5be4581
  • SHA1 97967410a38fc690e9c16f49fa052be39f8a1686
  • SHA512 a472e41a1b7140ff33c11aef06e8295b74eb557f534bba08d439fb8d774e728af50bf30b6d8f01b6796866a14c54be92b99ae43675eb16f98149448027a71678
  • SSDEEP 3145728:0kOEjg+l6N6lRMsY9S1C9BKmJHPnsDuachledEkfJ0Vi8ycD:0kOZIMsbUb1JHPnsKeCu0Vi/m
  • TLSH
    T10D583347ACA144EAC46A6B3289B382967B35FC450F3533DB2E98B5383E767D19C36350
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistenceransomware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2