Extracted

• • Target
    2026-07-17_404b0f010ae114f531ecbae1b2869259_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 22.1MB
  • SHA256 09a6d7a954a3df983bb5ee9763c4860927c21ee097a65ed51e3081859b834cf0
  • MD5 404b0f010ae114f531ecbae1b2869259
  • SHA1 838f8a2cdd9880a5fc15568a6af10569993a90ac
  • SHA512 0eb339306e9e79db6402e486408bb28c8856227f60f5cb19e661a97c3040f514353b94483e2cda1139a7631b34f66f28cd8e0abfc8c9524e4edf0ade1f61c6fa
  • SSDEEP 393216:Hb4EGO0Am8hm/+Feep7ZHOhpmoQIzKCy7Dk+Zra7Se4i1sYXooyGbE0/0tVXAY0:Hb4w0Am8hyweepV63Zy74+Zze4i1s25/
  • TLSH
    T1AC3723576CE008EAC4AA973189B662927B70FC4A0F3163D72E90B7782F727E09D75744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerpersistencespywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2