Extracted

• • Target
    2026-09-10_76e6c3f163227659f65addde107006cf_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 8.1MB
  • SHA256 a3042422dbd36ddc9ea2756afd9c94d6a11c4109b185c5e8e63038e268006682
  • MD5 76e6c3f163227659f65addde107006cf
  • SHA1 eb7ac57e36f94d8f3dcdff146c844bae8dbeeee4
  • SHA512 03136066314400d12c4c56d22c8ddaaf31317eab94dda611d5fb41e44e3356ce50eb93aceb7436bde58c4e3eec71e56ef8c8862a599e95234cc36e5cb4074aa3
  • SSDEEP 196608:wM+04boqh+04boqAOis2X4zDfL/lMe2a90CV2rxp:wMO8qhO8qlis2X+KebUrxp
  • TLSH
    T12A863356DB7D85BCE4F3B2708D47CE03D37A34445BA1A5CF536864AA4F139A00E3E62A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2