Extracted

• • Target
    2026-08-08_4e602e1d34fed29733341f6c86179568_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 88.4MB
  • SHA256 7436efeeae1da18477b06f8238f4910ed9d099bbf377cbd83c253796f5daedad
  • MD5 4e602e1d34fed29733341f6c86179568
  • SHA1 257c8e27999e7dd4fdc6a2ac1cdbb39b9a577ddc
  • SHA512 d9e650f7104a356e5969d34ec1321447b1234a559494ec726844dcfa92425d78185d5853d77eeaf26e8b82d5e5ed687c77e0a393e4318f875dd19776afd31235
  • SSDEEP 1572864:Cu0chCuSNbVgZy2tY0h6VNtjTcMC0DNBTsy8fAToZbtnoANRLE3:CTcsuSBONhWUMC0Dp8fAwBoGlE3
  • TLSH
    T1711833B9F6F517A8D46AD230CD36438ADF072C4907B068DF22D879EA2D7727059AC742
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  volvodiscoveryquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2