For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples