Extracted

• • Target
    2026-07-15_1581725c2cdbd7ebe678954760bf7caa_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 3.1MB
  • SHA256 966365f729aadfc95f0450a1a605422b63d7fc2628310108e26054ed04fbf03b
  • MD5 1581725c2cdbd7ebe678954760bf7caa
  • SHA1 fd8a005b498018cdd6ce09bbb68ada8dc3d00af0
  • SHA512 f8d684c9bcfc091720fc2401f278c0ab4f66bf2a70efdda83e8d552d3efd43966cf495061b8fdd558e5ca3a9fe2e3863998738ab988995d261de343b1b339519
  • SSDEEP 24576:tWJ0I8PECBg3e32bsxokdssNYnV0538xqwEmGWaJQJW2iThn3SVp8SU+qnnhvAoe:tWJa8CD3SsxrKqlBfwEySvStprQMv
  • TLSH
    T1C6E53A07BD9108E6C49AE63188B652527B74BC0D1B3233DB2E90BBB82E737D05D79B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealerclipperanimateclipper

  • Detects AnimateClipper

  • Detects Remus stealer

  • Family: AnimateClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2