Extracted

• • Target
    2026-08-22_e498b2be694e75fcbca0265f908e0e3c_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 5.2MB
  • SHA256 33a7cb441927478c5fa646035c465ed07a29de19d1d8eff2e0a33d2079789dbc
  • MD5 e498b2be694e75fcbca0265f908e0e3c
  • SHA1 e7a56e58d0519f269e2309df0d97e8f7c3c47efe
  • SHA512 fe4b48846196eb0da62b1f0c0db8b79a044a443a557cdd61ddb2a6a4e210d882eb0743080fb5681a083255bd28e61236190a2b8aaa6f498f99f8a5dddc8dabe8
  • SSDEEP 98304:uvOBs8OioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEnX:NPOis2X4zDfL/lMe2a90CV2rxy
  • TLSH
    T1C9462326E7AC45BDE1B7B1748853CD07E33A750827B1E98F1768A4AA4F235D04F2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2