Extracted

• • Target
    2026-08-04_880b6c734a76df6472e0b6e7706a817d_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 7.0MB
  • SHA256 17d6d00811b4f1ce7614afd88c694d0dc37eace8da5ea910046d7fe766cd0cb8
  • MD5 880b6c734a76df6472e0b6e7706a817d
  • SHA1 467764ae1023a8e0ca3d49c20d3bd5673cf506b9
  • SHA512 d8f41f7cc5b4120dcd0963bae1f1749e525870a545cd873234ddcf0a728770e6841ddc9d5669417dfaff482dab81ba25d76525122e12d4df2068db0ef4a566ef
  • SSDEEP 98304:IvO83Lebiv2JS3Lebiv2J0s6OioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp1:f83Lv3LpOis2X4zDfL/lMe2a90CV2rxA
  • TLSH
    T1D0762325D66C80EFE5B7B2748856CD4FE23E35082761E98F0AAAB0DD8F176C01B2D751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2