Extracted

• • Target
    2026-09-30_24ac0343341b817ef677724338876633_glassworm_hijackloader_icedid_luca-stealer_ngrbot_njrat_vidar
  • Size 4.8MB
  • SHA256 46393e1d9fdc79e5bd3e65400eea55f77e083eb53ad735ddb8e286a707e8ffff
  • MD5 24ac0343341b817ef677724338876633
  • SHA1 a6a514cff4a1c71f6def0cb711c1119e61ca927a
  • SHA512 f38c7e38d0ffff1f942900adafb62c533c1cd48cc4330bd8b6f5362435a9f5beb55b0887f9947a19d21d190b1fe01e578fd6409e64519751667074650f59b424
  • SSDEEP 98304:dQwj+Y9Nzm31PMoiJhcXQD1GZjAkjixi:mY9NzgMo9
  • TLSH
    T1ED369E07B3A801ACD5ABD27885575707E7B174061321E7DB16E08AAD2F23FE56B7B320
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionaesthetic_stealerpersistencestealertrojan

  • Family: AestheticStealer

    AestheticStealer is a Windows stealer written in C#.

    stealeraesthetic_stealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects encrypted or obfuscated .NET executables

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables using Telegram Chat Bot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2