Extracted

• • Target
    2026-07-08_793a40ce5b002ade490125ac90958e40_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.1MB
  • SHA256 af62fd9b1b04102de52d06b2c56fe0a87219e4bde4c278e5969f3398daeed515
  • MD5 793a40ce5b002ade490125ac90958e40
  • SHA1 a7bf103b299aee032f7f21c203b376c1cbd7ea6d
  • SHA512 a1eb40d64e5f59bead07603ec4767a9d63e4c6e0746e5a7717824707fef8f8b1bd761646b3d3446d73909481a2e665f4d201c71c522ecd5f3a97b1baa9dc6954
  • SSDEEP 24576:6mVIrm4Y+xca5A3+2JHFtv4/G4RoB6TAeGKCk1uAVwoAtxzBele5rK2mMxgCOL:6m6q4Y+maSu2RFtvWlR/5BuA441
  • TLSH
    T168A56B0B7CE109EAD4AA933188B652957B74FC094F3263D72E90B6782F727D09C79790
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerstealeradwarepersistenceransomwarespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2