Extracted

• • Target
    2026-08-02_c9fed0b99e8eb89d5466eaefe2dd01b7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 44.9MB
  • SHA256 7359bbc27fbca26ab73d7c7e97d3d166a130da8ac400cd97a7309e423d5a5899
  • MD5 c9fed0b99e8eb89d5466eaefe2dd01b7
  • SHA1 c6a56b2ed7d6170c02ab25b7c28391d5ace37fb5
  • SHA512 d5da25244c03dc848cb28c0599783b4aa7407992c57325656a54ae91a4d2d235091bd4f77e4be4a74137fd27eb57b184f754c37520b306aa2bcacf6a980dfcd4
  • SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfR:sMguj8Q4VfvvqFTrY8/Wyr
  • TLSH
    T199A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionremus_stealerpersistencestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Detects executables containing URLs to raw contents of a Github gist

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2