Extracted

• • Target
    2026-07-09_fbd4e3e7e55b63bd80f278264a9d84b3_coinminer_dcrat_drokbk_elex_glassworm_quasar-rat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 2.8MB
  • SHA256 8f974df674ef152a3dc58369de212a124b535289c4545d3dad7bff1225ed30cf
  • MD5 fbd4e3e7e55b63bd80f278264a9d84b3
  • SHA1 4b53a9b532fa931589de9e9a5051941592b8b50e
  • SHA512 f861e0c3bf624789a9d69fb0b578fe5744a8003175431f2d1157ab29f282735a7a32d282e4b78a59a897a1f1cef2b8b82bdbd6c46721add4336dab3de85d5f48
  • SSDEEP 49152:NkQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpoa1ZFC/k:NaK5CbhZcT2lvnDFpFW/twU7+oU
  • TLSH
    T19FD5DF342DEA502AF177AF3D8AD07596DA6EB6A33707994E10B103C60B23B42DDD153E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderdcratsnojaninfostealerratupxadwarepersistenceransomwarespyware

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • Detects executables containing bas64 encoded gzip files

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2