Extracted

• • Target
    2026-08-02_9bfa4d8625be6bffa7ae433d30f6ad1e_cobalt-strike_icedid
  • Size 332KB
  • SHA256 1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f
  • MD5 9bfa4d8625be6bffa7ae433d30f6ad1e
  • SHA1 220f8c63b76dbb5de1f0f7ca4cc9fad2c5b896d3
  • SHA512 cfc1357d37e83c101fdfe8001a6d44b89ff3fefb08f7de004be4a0c800bebc88979f2ecc27022581a6a9a4e17ca4d652ee9ef602730f29fe9e81231d65286f1d
  • SSDEEP 6144:QEJVrl1rJrnc1VgBk48Zb8J9EYqERHgb3ONNoX3LiB6jI2Xgx7FsTXO:RVrl1rJDczN41J9xAY6biMlQbsTXO
  • TLSH
    T17C74AD1AF2A251E8D06E8475CB104A52FA773D2243D0DA6F16D4F63D6F32690ADD8F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2