Extracted

• • Target
    2026-07-17_dbdc539ce2276d056e3da79e5b556cba_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.6MB
  • SHA256 54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562
  • MD5 dbdc539ce2276d056e3da79e5b556cba
  • SHA1 be359a25b1ed3d17fb2aad16d8d6c81fcda6a319
  • SHA512 0b0dc1de21aa6ce6958820cbadb00b3860af99af0efb48a9657ceeae4769efda2079faad8f2518306a30828a30e9e928f4bef81a67eb96130abedc708e77400f
  • SSDEEP 24576:yub+9ZWgfIzjTrZwAShG/dspMwRuytjtGDBRmT2w+wazAoBele5r9DXmm5dEADk8:yubQJfgTVNS4l+OytjtuCTtO9lA8
  • TLSH
    T1BFC54A17BD9048E9C09AE33289A74656BB75BC4C0B3233E72E90BA782F727D05D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoveryspyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2