2026-09-28_dee56f4b66251dc99431edac396f40a6_cobalt-strike_coinminer_icedid_njrat_remcos_vidar
Remcos RAT with keylogger, injection
Remcos native RAT agent with remote file taskingNative RAT downloads, executes, and uploads controller-tasked files
SHA-256e9c43619d252472e9ff5f0851104585e78e851d0c78d84e95f11f033c9a733c7
Evidence
⋯3 more rows
0x73fe842270000740000004427000075000000B'..t...D'..u...
0x73ff843270000760000004727000077000000C'..v...G'..w...
0x740083a2700007b000000492700007e000000:'..{...I'..~...
0x7401836270000800000003d270000820000006'......='......
0x740283b270000870000003927000088000000;'......9'......
0x740384c2700008a000000332700008c000000L'......3'......
0x7404800000000000000006600000000000000........f.......
0x7408878570740010000000700000000000000xW.@............
0x7409890570740010000002100000000000000.W.@....!.......
0x740a8a8570740010000000e00000000000000.W.@............
0x740b8c0570740010000000900000000000000.W.@............
0x740d8e8570740010000002000000000000000.W.@.... .......
0x7412858580740010000001200000000000000XX.@............
0x7414888580740010000001000000000000000.X.@............
0x74158a8580740010000002900000000000000.X.@....).......
0x74168c0580740010000000800000000000000.X.@............
0x74178d8580740010000001100000000000000.X.@............
0x74188f0580740010000001b00000000000000.X.@............
0x7419800590740010000002600000000000000.Y.@....&.......
0x741a810590740010000002800000000000000.Y.@....(.......
0x741d858590740010000002a00000000000000XY.@....*.......
0x741e870590740010000001900000000000000pY.@............
0x741f888590740010000000400000000000000.Y.@............
0x74208b0590740010000001600000000000000.Y.@............
0x74218c0590740010000001d00000000000000.Y.@............
0x74228d8590740010000000500000000000000.Y.@............
0x74238e8590740010000001500000000000000.Y.@............
0x74298505a0740010000000a00000000000000PZ.@............
⋯7 more rows
0x8522874000000010000000000000000000000t...............
0x85238636d642e6578650053797374656d4472cmd.exe.SystemDr
0x85248697665005c0000000a00000000000000ive.\...........
⋯11 more rows
0x85308680072006f006d0065002e0065007800h.r.o.m.e...e.x.
0x8531865000000000000005c00420072006100e.......\.B.r.a.
0x853287600650053006f006600740077006100v.e.S.o.f.t.w.a.
0x85338720065005c0042007200610076006500r.e.\.B.r.a.v.e.
0x853482d00420072006f007700730065007200-.B.r.o.w.s.e.r.
0x853585c004100700070006c00690063006100\.A.p.p.l.i.c.a.
⋯3 more rows
0x8539800000000330000003100000030000000....3...1...0...
0x853a84d00000000000000737663686f73742eM.......svchost.
0x853b8657865002200000020002d0073006900exe."... .-.s.i.
0x853c8640020002d0061006300630065007000d. .-.a.c.c.e.p.
⋯8 more rows
0x854586c002e0064006c006c00000000000000l...d.l.l.......
0x854684e74416c6c6f63617465566972747561NtAllocateVirtua
0x854786c4d656d6f7279004e74467265655669lMemory.NtFreeVi
0x85488727475616c4d656d6f72790000000000rtualMemory.....
0x8549852746c416371756972655065624c6f63RtlAcquirePebLoc
0x854a86b0000000000000052746c52656c6561k.......RtlRelea
⋯5 more rows
0x85da8bc21014001000000c413014001000000.!.@.......@....
0x85db84c004f00430041004c00410050005000L.O.C.A.L.A.P.P.
0x85dc844004100540041000000000000000000D.A.T.A.........
0x85dd85500730065007200500072006f006600U.s.e.r.P.r.o.f.
0x85de869006c00650000005c00410070007000i.l.e...\.A.p.p.
0x85df844006100740061005c004c006f006300D.a.t.a.\.L.o.c.
0x85e0861006c00000000004100500050004400a.l.....A.P.P.D.
0x85e1841005400410000005c00410070007000A.T.A...\.A.p.p.
0x85e2844006100740061005c0052006f006100D.a.t.a.\.R.o.a.
0x85e386d0069006e0067000000000000000000m.i.n.g.........
0x85e485c004c006f00670069006e0020004400\.L.o.g.i.n. .D.
0x85e5861007400610000005c0043006f006f00a.t.a...\.C.o.o.
0x85e686b006900650073000000000000000000k.i.e.s.........
0x85e785c004e006500740077006f0072006b00\.N.e.t.w.o.r.k.
0x85e885c0043006f006f006b00690065007300\.C.o.o.k.i.e.s.
⋯4 more rows
0x85ed820666f756e642c20636c656172656421 found, cleared!
0x85ee85d000000000000004c006f0067006900].......L.o.g.i.
0x85ef86e002000440061007400610000000000n. .D.a.t.a.....
0x85f0853746f7265644c6f67696e7300000000StoredLogins....
⋯11 more rows
0x85fc800000000000000005c00420072006100........\.B.r.a.
0x85fd87600650053006f006600740077006100v.e.S.o.f.t.w.a.
0x85fe8720065005c0042007200610076006500r.e.\.B.r.a.v.e.
0x85ff82d00420072006f007700730065007200-.B.r.o.w.s.e.r.
0x860085c005500730065007200200044006100\.U.s.e.r. .D.a.
0x8601874006100000000004272617665000000t.a.....Brave...
0x8602800000000000000005c00590061006e00........\.Y.a.n.
0x860386400650078005c00590061006e006400d.e.x.\.Y.a.n.d.
0x8604865007800420072006f00770073006500e.x.B.r.o.w.s.e.
⋯7 more rows
0x866246c0065007400650046006f006c006400l.e.t.e.F.o.l.d.
0x8663465007200200022000000000066007300e.r. .".....f.s.
0x866446f002e00440065006c00650074006500o...D.e.l.e.t.e.
0x86654460069006c0065002800570073006300F.i.l.e.(.W.s.c.
0x8666472006900700074002e00530063007200r.i.p.t...S.c.r.
0x86674690070007400460075006c006c004e00i.p.t.F.u.l.l.N.
0x8668461006d0065002900000000005c007500a.m.e.).....\.u.
0x86694700064006100740065002e0076006200p.d.a.t.e...v.b.
0x866a4730000000a0000000000000022002200s...........".".
0x866b422002c00200030000000000043007200".,. .0.....C.r.
0x866c465006100740065004f0062006a006500e.a.t.e.O.b.j.e.
0x866d463007400280022005700530063007200c.t.(.".W.S.c.r.
0x866e46900700074002e005300680065006c00i.p.t...S.h.e.l.
0x866f46c00220029002e00520075006e002000l.".)...R.u.n. .
0x86704220063006d00640020002f0063002000".c.m.d. ./.c. .
0x8671422002200000000000000000043007200".".........C.r.
0x8672465006100740065004f0062006a006500e.a.t.e.O.b.j.e.
0x8673463007400280022005300630072006900c.t.(.".S.c.r.i.
0x867447000740069006e0067002e0046006900p.t.i.n.g...F.i.
0x867546c006500530079007300740065006d00l.e.S.y.s.t.e.m.
0x867644f0062006a0065006300740022002900O.b.j.e.c.t.".).
0x867742e00440065006c006500740065004600..D.e.l.e.t.e.F.
⋯9 more rows
0x8681400000000410070007000440061007400....A.p.p.D.a.t.
0x8682461000000500072006f00670072006100a...P.r.o.g.r.a.
0x868346d004400610074006100000074696d65m.D.a.t.a...time
⋯4 more rows
0x868842d57000057440000000000006c696365-W..WD......lice
0x868946e636500206269742900000052656d63nce. bit)...Remc
0x868a46f73204167656e7420696e697469616cos Agent initial
⋯3 more rows
0x8b9207368636f726500007573657233320000shcore..user32..
0x8b9304e74556e6d6170566965774f66536563NtUnmapViewOfSec
0x8b94074696f6e000000006e74646c6c000000tion....ntdll...
0x8b950476c6f62616c4d656d6f727953746174GlobalMemoryStat
0x8b96075734578000000004973576f77363450usEx....IsWow64P
0x8b970726f636573730000476574436f6d7075rocess..GetCompu
0x8b9807465724e616d65457857000000000000terNameExW......
0x8b990497355736572416e41646d696e000000IsUserAnAdmin...
0x8b9a05368656c6c33320053657450726f6365Shell32.SetProce
⋯7 more rows
0x8ba206c6557696e646f770000000000000000leWindow........
0x8ba304e7453757370656e6450726f63657373NtSuspendProcess
0x8ba4000000000000000004e74526573756d65........NtResume
0x8ba5050726f6365737300476574457874656eProcess.GetExten
0x8ba606465645463705461626c650000000000dedTcpTable.....
⋯3 more rows
0x8baa06964546f537472696e67536964410000idToStringSidA..
0x8bab041647661706933322e646c6c00000000Advapi32.dll....
0x8bac052746c476574436f6d7072657373696fRtlGetCompressio
0x8bad06e576f726b537061636553697a650000nWorkSpaceSize..
0x8bae052746c436f6d70726573734275666665RtlCompressBuffe
0x8baf0720000000000000052746c4465636f6dr.......RtlDecom
0x8bb0070726573734275666665720061000000pressBuffer.a...
0x8bb10434f4e4f555424000000000000000000CONOUT$.........
0x8bb200a09205f5f5f5f5f5f20202020202020.. ______
0x8bb3020202020202020202020202020202020
0x8bb40202020202020200a09285f5f5f5f5f20 ..(_____
0x8bb505c202020202020202020202020202020\
0x8bb6020202020202020202020202020200a09 ..
0x8bb70205f5f5f5f5f2920295f5f5f5f5f205f _____) )_____ _
0x8bb805f5f5f2020205f5f5f5f205f5f5f2020___ ____ ___
0x8bb90205f5f5f200a097c20205f5f20202f7c ___ ..| __ /|
0x8bba0205f5f5f207c202020205c202f205f5f ___ | \ / __
0x8bbb05f29205f205c202f5f5f5f290a097c20_) _ \ /___)..|
0x8bbc07c20205c205c7c205f5f5f5f7c207c20| \ \| ____| |
0x8bbd07c202820285f5f7c207c5f7c207c5f5f| ( (__| |_| |__
0x8bbe05f207c0a097c5f7c2020207c5f7c5f5f_ |..|_| |_|__