Extracted

• • Target
    2026-07-02_f7b7aa290170d121e56e75e417de0d71_cobalt-strike_icedid_satacom_vidar
  • Size 20.3MB
  • SHA256 0d90f27e0c8bc5113e1fcb1208d60b7194eba395eb4cf0643e67673d5bb5709d
  • MD5 f7b7aa290170d121e56e75e417de0d71
  • SHA1 3824d6661b550f42bde84cd6c9a04f230276883e
  • SHA512 caf6667710edf47bfb3d9f04f6b3a48e179408681847e50d852a28123bbfdd8c9ddd474832e953440b058a5bae59cdf686376a65dc9e21759227a58b1afd41d7
  • SSDEEP 393216:bx47E3XNAEYsR19WK5muE7zrir4buwSZ3iNuaihxNVeIEpefUwGQtDYwnq39P3:N47E3XNvYgE73iQ9SJaihTVtEpePhq39
  • TLSH
    T14227334ABD80D4C2E7A1D67992A2D2B8533D7C541F38875A92F93C6BBF743572E0130A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistencepyinstallerspywarestealerremus_stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Detects Reflective DLL injection artifacts

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Downloads MZ/PE file

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2