ROMULUS apparently used an 842 MiB executable to evade file-size scanning

ROMULUS was reported delivering malware through installers that look legitimate, giving attackers a way to put LegionLoader on victims’ systems. The ClickFix platform uses admin panels found on six servers and distributes trojanized Stardock installers alongside other payloads. One executable was padded to 842 MiB, apparently to get past file-size scanning limits.