Extracted

• • Target
    2026-07-16_74aebe0faae0c88a331e1a98608d4c38_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.9MB
  • SHA256 de8aa06bb5392209fcbff9dd645671dd1a864ccac5d2a1cc21fbb9b6cc5b1c72
  • MD5 74aebe0faae0c88a331e1a98608d4c38
  • SHA1 9d337173cd79e3a9c665ac688afe11d1528e0e19
  • SHA512 bb8a47542924d6d3a7246da09f07bbac1a56bc7746ecff492cac466bf771d006c96227ec5f9c32200ef9982476a13a283bb3268863fca4a4e9cabbe4675c876f
  • SSDEEP 49152:DCI+ntx1TUeAGtZzUcEnGWA2NIO1yFRN+z8tYq9OB:D2lWOTJi
  • TLSH
    T187E53907BD9508E9C09AE73189B692527B74BC0C0B3163D72EA0BB782F727D05E79B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoverypersistencespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2