Extracted

• • Target
    2026-08-13_c4ce4eff23b0b113b1caed63d6c00399_agent-tesla_amadey_icedid_luca-stealer_njrat
  • Size 1.2MB
  • SHA256 c4e42a20fc9f6866dc638387c121da7ec8ce4db70be98c19cc75e2341f438d75
  • MD5 c4ce4eff23b0b113b1caed63d6c00399
  • SHA1 2bd4c79b50e8c5a807c8821ee4425c621168bd25
  • SHA512 1b94501a2296695044518131009628df210ee2153d10578f6b0f5024cd5bf564c0fd5e518b4122919cd926b046938d4757fcc531759c9b271f1d837425e3993e
  • SSDEEP 24576:nCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrNnp1:A1H4jR2TYrQbDTrNnp
  • TLSH
    T1AA455A0573A4429DFEB7EF768A02C147D6B178B61237866F02606B766F33B611A3E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  futtiesdiscoveryexecutionasyncratpersistenceprivilege_escalationratspywarestealersuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects file containing reversed ASEP Autorun registry keys

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2