Extracted

• • Target
    2026-08-01_e285493e78bb47efe631538345cc0f04_glassworm_icedid_luca-stealer_njrat
  • Size 31.8MB
  • SHA256 fc06481206fb5b7e537fefcce77cbb66405aff275d0a65b42dbdd456ac210330
  • MD5 e285493e78bb47efe631538345cc0f04
  • SHA1 2e74f781ba81bec9739fffc020defcce395f5f1d
  • SHA512 b2f82231f0ce77778ded39913d9614a73fb00f7f1d1a7ed449cf7f23ebc598d9a37031b85bf1af975f60f52cfd8d2df22eb18a3b3a000ebc62db32b14436d905
  • SSDEEP 786432:I3GwSEGCoW8B0f1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhxPp:JwSEWWNdiIJ2qHWB75il4ZH5Fskp
  • TLSH
    T134773345379E0166E5BD56BAEEA0413363F1389F0760D39F9BA00E622E6F3C4DA35352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratpersistencepyinstallertrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2