Extracted

• • Target
    2026-08-15_117ebda2f463bda73cfe28350f2077d6_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 540KB
  • SHA256 c5186c2bd8b9d631477fd6149e19b044750efb5746733d9e0cace94d23702fe4
  • MD5 117ebda2f463bda73cfe28350f2077d6
  • SHA1 5ccd9173e152df121b56f594fad688803e05712b
  • SHA512 2fe66d856c5bbb1845928f67052918a07e8105bd055ddf27bb5e95d785d38a474ab32010027b3167c5aec5c722393a9ed53d7daf806ed1075d36159d0b41b30b
  • SSDEEP 6144:lae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHhAAWbOCLbVtt6o:tmiMZvN43+u85Bpw+YMRkc9fAtbrkRS
  • TLSH
    T122C48E19D7E405F8E0B7D178DD934912EB727C4947B1EA8F03A4A9A61F332909D3EB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryadwaredefaultdefense_evasionexecutionasyncratpersistenceratspyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects file containing reversed ASEP Autorun registry keys

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2