Extracted

• • Target
    2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 33.2MB
  • SHA256 bf93b1578a876f6bbd0368b9d91e78a5b57b499e906b7ceb8e534c1c55626153
  • MD5 37409f4530f6f1eea906b633903646bd
  • SHA1 0259ca91563f15dab4ff0ee0adc5e1555090f487
  • SHA512 a5064b80b82f520a9537254bb6d7c97c13c24d504fdef9f612b53326242fd7a245cb97cacfafa65b35bdff520891733edad337086e145d3967986f2019377c8a
  • SSDEEP 786432:SDcLHzPqxMSF8fg7amN79SA0X2d2lpIwBPunjMsIc:SDkzyxMSefg+CSfvSwRunRIc
  • TLSH
    T13B773318D77521B2E0EA99B8DE619757D3723CD00FB2C0DB12541A6ABEB37508E313B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryquasarinstallerspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Custom signature

    Detects executables manipulated with Fody

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2