Extracted

• • Target
    2026-07-09_c057ada483923b343838195154938596_coinminer_dcrat_drokbk_elex_glassworm_quasar-rat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 2.8MB
  • SHA256 1a778f898bb4743b60f34149ccda797d09e5f115fb91530ebe3eb1a2587ed11f
  • MD5 c057ada483923b343838195154938596
  • SHA1 cd303d50a614012ca6e955e43c33d2063b766b7e
  • SHA512 51010245ae25fb045e1f4462a2586950339a7df641c7b0dae168e5143e5bc908412954d260755ec61ad3374358cf1e9759b43f2787c87a012ba8f4093eb9039e
  • SSDEEP 49152:skQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpoa1ZFC/k:saK5CbhZcT2lvnDFpFW/twU7+oU
  • TLSH
    T161D5DF342DEA502AF177AF3D8AD07596DA6EB6A33707994E10B103C60B23B42DDD153E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderdcratsnojaninfostealerratupx

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • Detects executables containing bas64 encoded gzip files

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2