Extracted

• • Target
    2026-09-11_8c372dfffeb5e7f3b7ab774a4415d1c8_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 8.1MB
  • SHA256 f3d292ef1e6cdff5a6e27d19fec3fd79b7ff5150ed32dbe5d2051edf5b58806c
  • MD5 8c372dfffeb5e7f3b7ab774a4415d1c8
  • SHA1 ebdb3faaf2f5053e51651a6c06693cbeab7b0417
  • SHA512 0dc4f605a9a4c101880a790384f297ab720ae617e7548fa37b5568922cc314cd15faae0b89e7f866cf551688b9671cd6fa2abb7b918912a82446c91059e75b86
  • SSDEEP 196608:wM+04boqh+04boqXOis2X4zDfL/lMe2a90CV2rxi:wMO8qhO8q+is2X+KebUrxi
  • TLSH
    T16C863355EB7D85BCE4F3B2708C47CE07D37A34445BA1A5CF536864AA4F139A00E3E62A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2