Extracted

• • Target
    2026-08-15_0d520a7b43163b5db4e08033e2803430_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 42.6MB
  • SHA256 59c29ca61ed2ea3f7609455e40471be0c67dcf05b67142da045f8093790b0be8
  • MD5 0d520a7b43163b5db4e08033e2803430
  • SHA1 363644f323e7f811a652808287c805dd3b0d4b5e
  • SHA512 c8c5698ab45a0c5ec7fddb802896c656096d7a5d304312bc13297d84ef27b43f4c91a3deb4b5454ede1201fe0c7bac72d693998d710bd461b84955e310a476da
  • SSDEEP 786432:Cq8YvXT3rWej5UO/m1Zy1GHRJPP4HxCtdwMVMdh2H4od9BHeJx+jIyYtGXnNs70T:ChY/T3rDFHuy1mT4QH432H4EBH++jNai
  • TLSH
    T11EA7339AF28004FEE5ABE5369CD26442F17B3C4A9AF1DF9F45D44A140F33790183AB96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  workdiscoveryquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2