Extracted

• • Target
    2026-07-20_ef8bc214f7f0cd7647acf05ace8a48dd_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.9MB
  • SHA256 7125f2c15405a8884dc32667b06595b29c35158f39435296a447f232ee32d60f
  • MD5 ef8bc214f7f0cd7647acf05ace8a48dd
  • SHA1 e64a38f0dcec324202aa2c61f6cfdb63ed190d61
  • SHA512 214cfd180f370804beed7bf6b65c341a85ac6cb9f793e04049f5f5d4c57dcbf2cb9d1bb34ddd19360c6a1b088209c004f7c3c8b1aa0f32fc6894e26058fb7a17
  • SSDEEP 24576:yW2CBs2xaj7QCxNdi8nNX86pP5zLEhF0c9Dunwka5oqzng4dmgEKwugFoBeletIe:yW2zcaPfxNA8nl8eET0ZwNdWRkqhcck
  • TLSH
    T164D54907FC9148FAC099A235C9A75646BB75BC091B3623D72EA0BB782F727D05D39B10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2