Extracted

• • Target
    2026-07-14_153c65e53e0071530c820af396800357_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.3MB
  • SHA256 f6bab95954f5370b32405c53d2906fecd06d07823336b382780db58a2091a540
  • MD5 153c65e53e0071530c820af396800357
  • SHA1 3e31cdfc0771baf01dd8803f8596af01f025f662
  • SHA512 94d081c4a62ba77983fb7d88b7e04f02b008b5e74d26f1c11138dbdaf2bdfa02830f8b0ad4e2dddbf7afd35131df82c01fddbb425b7013e2a4eacf2d0a4c8489
  • SSDEEP 24576:CnMRMK80q/txaRayt3j3ZQiNjEc5iAUB3MJcCmPZ2Bele5IK2J8yLKJfqHz3dX:Cnq78F/Wo03jpxNjEc5rkcex7N
  • TLSH
    T10AB56B07BD9119EAC4AAA33189B261967B76BC081F3233D72F90B7782E727D05C35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2