Extracted

• • Target
    2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 26.5MB
  • SHA256 af0c5eebfe2dcffc7039c1bae13277a2a93693180cfa714dd0ec4ed75f9172fb
  • MD5 f67590dcd25e926e4e8f84da2950d5c8
  • SHA1 9bd4ae5e5d5c1c81fc099f9023fcd1fc1f6b3dd5
  • SHA512 80a09d2e6b19edb205902b05b0d0f3cec320905d74cfd2db573597111af157611896bea40f2e916151ae9caef24e581acfe0c68caaaa0fa871a56ace2e5e1106
  • SSDEEP 786432:1q8Y8CYD1D/jx9KWriOm/w+jG61JbqZQXzOC:1hY8Cs/fK5wV0bqQzh
  • TLSH
    T1D9573329F75585E8E1E7F8348D978D11D272B8098B7492EF12E952A96FA73C04C3BF01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  workdiscoveryquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2