Extracted

• • Target
    2026-07-11_1e0a31f91b9f8e1fc9a31eb65d6a19b9_icedid_luca-stealer_njrat
  • Size 22.5MB
  • SHA256 a37e318bd74d14d4d3480d779e0766410ded0eaeb71e16acff4ad50e054bda12
  • MD5 1e0a31f91b9f8e1fc9a31eb65d6a19b9
  • SHA1 6cf7c5583cdc2949dbd55e2d00426b408de9563e
  • SHA512 054c74f6c2e75f66d6ef1daf5758ea1ea32fa478b9edae4c4504f19fd843786073c7911d851d908faf4bfd81b64fd5d4d481b49f74c7e65c1888d78839514815
  • SSDEEP 393216:0cxGiGv2pyJ2JFWQYd1iHCMBNgWc8Ux1sAqoOrM6oHCN98pA5mdWHR9NpjjtA:0OKIyIPWJd1iHCENM8s1s9JrM6Nlmd8I
  • TLSH
    T1E73733A16BED03D8F1B786B09F744767A8367E639A21D76F005220540F39F619A78F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordonutloadervalleyrat_s2loaderpersistenceprivilege_escalationransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2