Extracted

• • Target
    2026-08-03_dfc1fc213308f30ecd03827cba52ec8e_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 7.0MB
  • SHA256 dbe63af01efad729f51f3b7a4912adfa993a14820018bec0710868957866c633
  • MD5 dfc1fc213308f30ecd03827cba52ec8e
  • SHA1 b498146f89ff22475eec3e7508230028a8bb6a03
  • SHA512 c92260b02b6ad9e317709bae236da61bd537efb858aa119054311a75d97a4a33cf6bf4abc1ec2f177926032cfafb1ac459f9e2feb9a2a5be52bab14d46a302a1
  • SSDEEP 196608:k83Lv3L5Ois2X4zDfL/lMe2a90CV2rx6y:kjis2X+KebUrx6y
  • TLSH
    T120762325D66C80FFE5B7A1748846CD4FE23E35082761E98F0AAAB0DD8F176D01B2D752
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2