Extracted

• • Target
    2026-07-18_bc4a779062e33deafacd023552b70b70_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.9MB
  • SHA256 5d16539260e3c23da6f5fee3ba39104fde4f68d4226a9957b1c7e35b4a9c1cd4
  • MD5 bc4a779062e33deafacd023552b70b70
  • SHA1 4080d4e71549072b27b24b5cb902d2d2cdb05da5
  • SHA512 a88e15546bcc2443b31437b3d4c85a8190cba7a495031bbfe86403ff9f3d5da49ed607f59d23c14d0208aa7b1f30d086931468438634ab3d89e7feb8744d9e96
  • SSDEEP 24576:405zch9PtYkS1ldgvsYd1jKfESvNL6Ux4Z9Aznd6Q3CFosvvAoBele5I9D/K9no2:405A/Py1Dgvvj+Nv96Azd6ZisQpJyga
  • TLSH
    T181E54A17ECA148F6D0A9A33289A782567B75BC081B3233EB2E907B382F727D05D35755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealerpersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2