Extracted

• • Target
    2026-08-20_afc206365c80eab8fb564d8073a34c8f_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 20.0MB
  • SHA256 944302a5d683f6e6f214147076e6b56e90d56cc93147fe2c616e354716712e04
  • MD5 afc206365c80eab8fb564d8073a34c8f
  • SHA1 82f476b03fd46729fce8de43d1961e9fe6740808
  • SHA512 d5b6e17201fe207d9ec257590b5bf6bead9414bfbabee63a07ed3c5dc63b478eec1d22a68520fe000562fa9870660c0563d7cb3704606c304628f51cff56c92c
  • SSDEEP 393216:l7WjzVB9g5hh5mvHFjAggoblVrh+U3BBaMjAr/l8uIxg1AxI:9gXOrolDgoBVrh+wsrNOB
  • TLSH
    T1972733A9D3EE11BAE1A5A0B1CA439957FFF3740D4361E58F13681A722E277948F25F00
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarksideratratonratpersistencestealertrojan

  • Detects DarkSideRAT

  • Detects RatonRAT payload

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables (downlaoders) containing URLs to raw contents of a paste

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables manipulated with Fody

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2