Extracted

• • Target
    2026-08-21_6c66a5720f35976345d324baf56fcd83_cobalt-strike_icedid
  • Size 286KB
  • SHA256 e313c09240d94d6f8aed6e6f4c802f1dce4e204cb7020e72d5344a8cd93b3b26
  • MD5 6c66a5720f35976345d324baf56fcd83
  • SHA1 9fa08cfd4286a11fcdfca4f9833952187e9d857f
  • SHA512 7c50142ec78c09c0d84cc059d3bffbe4ef271693d2635a84ffd08be0e17d2da0d757c71d2e4fb980cbe54af8be39a579f6a8f379544f304c08bc298269527087
  • SSDEEP 6144:R0rVrlm1wui0DNiJC7PAQW04qeZMa0H7ip4MQSe:IVrlm1w70h57bW02Ma0bip4Ye
  • TLSH
    T12C54BF45F7A660ECE1B78974C9154662FB7B3A560340AF6F0361CB72BF136A0BD18B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionremus_stealerpersistenceprivilege_escalationspywarestealerdiscovery

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2