Extracted

• • Target
    2026-08-16_0009ff00a4a3ed5c525190d41b1b2c7d_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 44.9MB
  • SHA256 fba9f6dc97ac27b726776c99922e882650e076a58deda979161ded1f38dd490e
  • MD5 0009ff00a4a3ed5c525190d41b1b2c7d
  • SHA1 3b81a169213343ed97bbff169db465accf30c586
  • SHA512 358d02db2daf7110abbff7f5b4863943cfbac23e33b1327fd8b07963bd805b2927765e7e16414130e06b6a9fb0a3e0be27a88c62ac5b7a1b8c374e37819af885
  • SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfd:sMguj8Q4VfvWqFTrYE/WyA
  • TLSH
    T174A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistencespywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Detects executables containing URLs to raw contents of a Github gist

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2