Extracted

• • Target
    2026-07-20_afc61229018541efa19cd9affa1aeb72_icedid_luca-stealer_njrat
  • Size 24.5MB
  • SHA256 98f5e6cc01bd74709e63639e75a6e4d68b6c5fb9654ae97490155792888bebdd
  • MD5 afc61229018541efa19cd9affa1aeb72
  • SHA1 b6cbc4017ed864b21917e3604c6e5f57d2e9ed0a
  • SHA512 7cd78c00ea9dad8b4c235d401c26a79dbaae3a85d48f9152de66ca8bf30718011eedc2e8cbda7e114ff1d756453fdb8198177820b34c61f7af513ac4848d7158
  • SSDEEP 393216:sr8iLu03Q36lpfK6lWNHdeRU7eRZ7mnKmn4jSi9daq09l6MPaClTTFNnj3Rbgao:s4iL7QqXRqwZinnn4ueaqEl6MVBp9gF
  • TLSH
    T13D473352F7F20398F4B3553149B8497BF4B6BC2EFA15DA9E018321091B27B9189A4F37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordonutloadervalleyrat_s2loaderpersistenceprivilege_escalationransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2