Extracted

• • Target
    2026-07-28_666b9577eca37a4bd5cf5994131c2527_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 2.5MB
  • SHA256 da6d395826af8f7869d4b59d68d152f09dda910518ab0f2b6fcdc94c4f96db41
  • MD5 666b9577eca37a4bd5cf5994131c2527
  • SHA1 4ef6bd98fdc158ad72091f556c0ddd1f3a6f60c2
  • SHA512 3bca0971af12829593923e5650cdd8b95a0de57a7d3ed69b9733c6828d930f3fd6bfc7c75c2ce684cd0021904d10544f2f3c95c3e17549685dc85db4556ad00c
  • SSDEEP 24576:vavTU1nX1yMSNo0T0WWqYESbpe76uWwYD7H19OJ7qvIdqPZoBele5I9DUAK7KGKu:vavoFXGNkWWIsLmJiRC+F8
  • TLSH
    T1B4C55903BDE108F6C0A9A33189B666527B71BC085B3627E72E90B7382F727D16D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2