Extracted

• • Target
    2026-08-13_e7207296471648669156ae5cd803ae4f_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 5.2MB
  • SHA256 df2f317050ad360e97ba278ea05d588d0f0631d5af627470d0b81c8b92474a8d
  • MD5 e7207296471648669156ae5cd803ae4f
  • SHA1 c622ef51a595c6c0e2bacd9048db499f9b8f2473
  • SHA512 8389624ca135fe94a8c30962feca3f81147c7962e3b3ec41f4689247f0443a54732cc99b64148d548b0c2137c244e08c11c2a7efe6f1b3964b26ba8b3187cdfa
  • SSDEEP 98304:XvOWsLOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEES:mHOis2X4zDfL/lMe2a90CV2rxs
  • TLSH
    T169462326E6AC45FDE5B7B1748C53CD07E33A75082771EA8F1768A4AA4F231D04B2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2