Extracted

Extracted

• • Target
    2026-07-19_2b9c8930e09dec2deb53ef5d34b39f2b_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 6.0MB
  • SHA256 67d501811b3dcd8aac76d9af44e427463d44c9d811d6c2dc43ece3cc12a42e4a
  • MD5 2b9c8930e09dec2deb53ef5d34b39f2b
  • SHA1 53c0ff9d229b0ffb38dc6b9fc8392b35542a6239
  • SHA512 8f21bf003af90d420facfef7d98505273852aa73f0be7bdf42c69792a0057e37a6775aed029341f896c9e792932ff47b400e092b1fd7db5c5ef400eb10439ab7
  • SSDEEP 49152:GnOC3kBwvEh849R3f7Qb8Dbb7whVBzhldPY1lEXs5jct+7wFBYLIaQisZWPDuhJu:GNMO43B7q3zHdg/UqhcQrOruZT
  • TLSH
    T104566B07AD9148FAC099A331C9A79246BB35BC081B3633EB2E907B782F727D05D39755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  test1discoveryremus_stealerstealcspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2