Extracted

• • Target
    2026-07-29_5a223c89b7baed1b7513ca6aec9728c0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 44.9MB
  • SHA256 6f26a68fabce865b6461a031fd3a18ecaa26d5ab9b8fb5002feeb97ba966392c
  • MD5 5a223c89b7baed1b7513ca6aec9728c0
  • SHA1 30cf373bec23340add73da90e5a57ccd6a97ac6e
  • SHA512 b7d30358fc66e56a900cd6da4087121d40d6e2dc4a2dd33301548fb21d17d7277e44eb445eedfcdb07eb6ea740159a37df850547f60f9f23ce2b82c20b464fa0
  • SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfz:sMguj8Q4VfvsqFTrYb/Wyb
  • TLSH
    T195A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistencespywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Detects executables containing URLs to raw contents of a Github gist

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2