Coyote: A multi-stage banking Trojan abusing the Squirrel installer

Kaspersky researchers describe "Coyote", a sophisticated Brazilian banking Trojan that uses a malicious Squirrel installer, an Electron/NodeJS loader and a Nim-based loader to unpack and run a .NET banker in memory; it achieves persistence via logon script registry keys, communicates with C2 via mutual TLS, supports overlays, keylogging, screenshots and remote commands, and includes IoCs and telemetry showing most infections originate in Brazil.