Extracted

• • Target
    2026-07-18_29944d7a8263195a36f26e6260848286_blankgrabber_glassworm_icedid_luca-stealer_njrat
  • Size 7.1MB
  • SHA256 d4ac0939f438d37b4e85779e62ebe79dbbfe86adeeb6b8eebd229808494a3ff8
  • MD5 29944d7a8263195a36f26e6260848286
  • SHA1 02a68fa8cb2f913ffcbc0a056062a63e22d19908
  • SHA512 d22995d0a5fcf4cf19f0256e474868109250d208901e40259d63a5c1461dda87de2507bed5061fcddc60f7fe3e2e5dcfd175353e287bafe06be814dbf0fd63b5
  • SSDEEP 196608:de2eFAurHSuhHToAUPNfGU5vXvcL2dIOZ+:dUAuXhHTodRGkX0KPA
  • TLSH
    T1C7763365B2D459F9FDB7E53C8A235210A37678410731C5EB03D886A27E376F02A39B72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2