Extracted

• • Target
    2026-08-02_a3a401a941e9b72d60c86dfcb6de7288_glassworm_icedid_luca-stealer_njrat
  • Size 32.0MB
  • SHA256 ce33e61a8aa1b86eb82cef714dea083d84da506c8f77382dd2ed4778f5e2c3b4
  • MD5 a3a401a941e9b72d60c86dfcb6de7288
  • SHA1 50111dd87c8c95e26405a441687485018c4d64b5
  • SHA512 7bc4ffb76a4107cebfc95a8da8a48f79cd65ea53aebc20fad65353707ab2c98e26a43f2fedd37539e92323e4368054f30066176751c14436fc5815c691c40a69
  • SSDEEP 786432:I3GwSEGCoW8B0f1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhxPL:JwSEWWNdiIJ2qHWB75il4ZH5FskL
  • TLSH
    T1C0773345379D0166E5BD53BAEEA1023363F1785B0760D38FAEA40A652E6F380DD32367
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratpersistencepyinstallertrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2