Extracted

• • Target
    2026-09-24_903d84c4c4bf9358ef2b9daa136e0b55_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 33.9MB
  • SHA256 385d0ffe385fa0a8c6120bf39c286fa1b55afd0a93485a842b4afb430ec3ff93
  • MD5 903d84c4c4bf9358ef2b9daa136e0b55
  • SHA1 0a6593da32c0f41dfd02f8c1b037ec48db78939e
  • SHA512 605870a6aeaed92d1a3632c3829fbae23bf98c209450fc1435a4e8f50f2c263c0ac5dbbeebac846cb6cce2e739737796da4df6788eb880d7f6889108e3b92663
  • SSDEEP 786432:UK8TCKrchroMbYlMYwZQAVmICYOYbSh7q9HUa5U1s66FEuuLcIrwBE4H:Z8/Yhrr4AVmIlbSmU1sLFRIrC
  • TLSH
    T110773305F7805199E0B18C7ECD46EB12F331384A57F2156F1BA86EAB3FEA551903BB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  stardock start11 x64discoveryexecutionquasarinstallerpersistenceransomwarespywaretrojanadware

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2