Extracted

• • Target
    2026-08-30_e0d611826d101f655f0f6dea4cda4be3_cobalt-strike_elex_luca-stealer_swisyn
  • Size 4.0MB
  • SHA256 75ab853f359e7bebe21607644dd903b1a8df49e1fca55a0fe815536ce911ba62
  • MD5 e0d611826d101f655f0f6dea4cda4be3
  • SHA1 c4479eef8ef05eb7a85cfeaf4789cb6cca89e560
  • SHA512 28aa903f347844400677bac73a6f2772dc859bb6112fc048931fcfec4a6f1707c1d13949a7746d7ebfcaed0a7404f3e55c5c8c40e5cae81d6e2640b199e57445
  • SSDEEP 49152:tSIgNbEyP9Ywho+t6TfWFScWQ9Zg9215KVvIqIQ0uMIMmtNrONWnhRY4uq6fDOOf:ql9Y0t6CFzW2
  • TLSH
    T147165C037E5450B4C4A6DB38C47B5352B620BC898B3437E72E55ABB52FB23D0AEB5B44
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryremus_stealerpersistencespywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2