Extracted

• • Target
    2026-09-19_f7bf286f64d9a755c2cc3b1901bdf34c_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
  • Size 1.3MB
  • SHA256 c5c9b8f3ea3ac0226976828a7ef58b3631121a54098ecd71c5d770fe7e84bc4b
  • MD5 f7bf286f64d9a755c2cc3b1901bdf34c
  • SHA1 bb258b37cecd925a3d8d84660ae4f57eeada23d7
  • SHA512 69661cb500f38e34cdb985be178d5f39f64e5363f6b622c8af616b24379d04546af4f50e8fe6486d37b0873c12a90a9cc6427081f5b6e1fd6a386ac5de13dc15
  • SSDEEP 24576:3BnSh9eCojTHHpXKune0W7aLi/XWUSFhO9kl31k8/:pShLoj7Hpauy7EidSL4gu8
  • TLSH
    T13055AD67F74520D9C42BE532B456B82F66A33C960BB1A6EF618472F41F372E14B39708
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultasyncratdonutloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Executes dropped EXE

  behavioral1behavioral2