Extracted

• • Target
    2026-07-23_0a7d47f61cb049daea088f05d3c53e50_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 5.1MB
  • SHA256 256188ac359f5aa2755531c7d48b8b992988dd8f4e8429fde441bca2d6a23086
  • MD5 0a7d47f61cb049daea088f05d3c53e50
  • SHA1 544cb75143f479d35843d4e4c3b9c99d42a0a741
  • SHA512 df803d2b22b4d6deccc043b430ff1a00ec6780228c1b901b8294d581b79f34cd75d5404a92c2e5058adb50eba6f90dc57b3a668b931b5b4ccbecfa9b4420e3c8
  • SSDEEP 98304:3vOBsNOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxET:GkOis2X4zDfL/lMe2a90CV2rxw
  • TLSH
    T1F5462326D7AC45BDE5B7B1748893CD07E33A75082771EA8F1768A4AA4F231D04F2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  0723executionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2