Extracted

Extracted

Extracted

• • Target
    2026-08-25_dc4439c7eb5e6ff36c8c99b8e5378e02_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 1.3MB
  • SHA256 ab8ebb8c0833654ea9671503f46e241ccb4d01502167ee3cd91ffc7fa73ee1f4
  • MD5 dc4439c7eb5e6ff36c8c99b8e5378e02
  • SHA1 44f99e39edd97634fa30c03b51d6efbccf97b7fe
  • SHA512 5051b2baecb09385d36ee252300a3bf390be8fe1b0a0079a70f870b12b200140c095a035418ba707e1cfb4d8b621da0a9fea6cd69bf665cea9bd1ec810b2d8f4
  • SSDEEP 24576:tnvS+55BpfRX9GUuNAtr6YUL/LPFkhsDR1PxAXwoR4ituz34k47t4xC+tkNgXaVv:tKA5/fBsDAZ6YQPFxbiXwS4iEzok47tl
  • TLSH
    T12F55D018D3E41CB9E0A3A1F7C9528B15E733784917B1E78FC7AC59961F236508A3BB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  pwdiscoveryexecutionasyncratvjw0rmpersistenceprivilege_escalationrattrojanupxworm

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Custom signature

    Detects executables attemping to enumerate video devices using WMI

  • Custom signature

    UPX dump on OEP (original entry point)

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2