Extracted

• • Target
    2026-08-09_49b1aa9a9ddfc29e6bf3d6cd0d30593a_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 7.4MB
  • SHA256 0bf27a1a266d9e5a5bf69570ed28459f816c7f2c37243a5962439ff4755d8e72
  • MD5 49b1aa9a9ddfc29e6bf3d6cd0d30593a
  • SHA1 841a75d51662e4948366cf5d4bcb413ea17e161d
  • SHA512 b262c1b68ab366201faf0a681f29ec7c86eda8a022c99281e004898a376aff8f2728798b2b8fe82bd593e0f65e479cc017cb06f7feb61c99cb5ecc26d1fdfd0c
  • SSDEEP 196608:ZIwI2wIGOis2X4zDfL/lMe2a90CV2rxSm:Z5is2X+KebUrxN
  • TLSH
    T1AE763372D67C05BCE067B274D857CC07E63A71096761E98F1778A4AA8F276C04F2E722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  0803executionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2