Extracted

• • Target
    2026-07-23_10061fd5a7fe3587d0fb0160a9516eff_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 2.7MB
  • SHA256 5c912d66a53bcbb0d7029fa80037e75339095b7d8c9b68914fbabf20bc8acfaf
  • MD5 10061fd5a7fe3587d0fb0160a9516eff
  • SHA1 656cfbab7ea749cace1a1d54dd91ae487d3a06bb
  • SHA512 3ee9ad020e80b9fd08578d0c9b8c2d2ee128a7dce8a87896c183f96be5ea594e2e7295c72b0a038204540ff8c3331527619016b46c5d8a0f3af670f0cb373d69
  • SSDEEP 49152:A6xcx0yf64qx4oDUa8BCL5bTLL/HXCgC2rW4CmdMD4brIUS9RVQI6nql6edWaoTP:A6Iv6WmZ8BELugCR4tamrNARVQFO6moz
  • TLSH
    T12FD51219D7F449F8E0B3E178CD934906EB72784947A0E78F03A855661F376D09E3AB22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  akushu chammar haexecutiondefendnotquasarhacktoolpersistencespywaretrojan

  • Detects Defendnot

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables manipulated with Fody

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2