Extracted

• • Target
    2026-08-04_bf60516eca2ba351c586ec4592c6797b_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 7.0MB
  • SHA256 2b8d46ad623bdd8e6961bf0ff69bdd2b0ab73e54fb98fb383ce1a10dffa49e44
  • MD5 bf60516eca2ba351c586ec4592c6797b
  • SHA1 a16a3d896e24c0881c18fa4fec80ab54df90a99a
  • SHA512 04abdbafaf0eab2ee1e7e4dd3ffe31c9643a253cc8b6e910171a56c2ac0c55c500bdb18ec79ad41daea1995743e883deefb803c356c1c03818479be6e3277e07
  • SSDEEP 98304:xvO83Lebiv2JS3Lebiv2JBsYOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmpz:Y83Lv3LgOis2X4zDfL/lMe2a90CV2rxC
  • TLSH
    T18C762325D66C80EFE5B7A1748846CD0FE23E35092761E98F0AAAB4DDCF176C01B2D752
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2