Extracted

• • Target
    2026-08-12_aa90c8566901be87fa9b1a595e99c679_cobalt-strike_glassworm_icedid_luca-stealer_njrat
  • Size 31.5MB
  • SHA256 ef248d0a27e4d7eb9c22e96f103fc24b24d3c56b7598d5e43def6ae3cbe8e480
  • MD5 aa90c8566901be87fa9b1a595e99c679
  • SHA1 aa79c772783e33c2270e20c94879c41496e3b796
  • SHA512 ca73dd523c6aeefa0ff9152d2150ce8afcdb98992e44b47ccd54241826f7f5e510fcf5a2280fb6a40229dabda7fb285a629b7e2ba270e4262dff29f1ea22000b
  • SSDEEP 786432:/Q3GwSEGCoW8AV0f1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhx4:/xwSEWWqdiIJ2qHWB75il4ZH5FsF
  • TLSH
    T1ED7733563BEA00A8F3EADA7A9BD4D1FF95A2B477032491BB57A00B020B179D0DD35731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionneptuneratpersistencepyinstallertrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  behavioral1behavioral2