Extracted

• • Target
    2026-07-10_6f4c410c27655b5da87800e3cbb376c2_icedid_luca-stealer_njrat
  • Size 20.4MB
  • SHA256 52e4663ae0f1aded572a1d14ad1437761ff0a09e4a667d24375784eef6499a7b
  • MD5 6f4c410c27655b5da87800e3cbb376c2
  • SHA1 72e96801b8d7efe4a4e902ed49d76a93b89620bc
  • SHA512 0c98964a406a6b6b19b530b3cccf7e82f0ca745a5a9ea01de2c5be2bf034cd21ac460b677cf9c53ccbf9f4682bf2894fae1a33e36a28d1f4e5e9fcb958f005f2
  • SSDEEP 393216:7uEaUrqe8oXxSgRt8LEkG08csATjFRpaMd0bb7+qhoCfl:6EhrqdohSm8n78GnaXvyAHt
  • TLSH
    T12D27331413FA0376F5F3DF70AEB49615E8BBBD2AE560C64D8060111D2E3A662D862F37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordonutloadervalleyrat_s2loaderpersistenceprivilege_escalationransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2