Extracted

• • Target
    2026-09-29_9b577587056a8da317aa6aaed7579dce_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 3.2MB
  • SHA256 c1702c0c0e837237fed170671932d37bfc70ebc75b7babba9e947ef60e6f7df6
  • MD5 9b577587056a8da317aa6aaed7579dce
  • SHA1 166626d975ddb9e708212f81f690b7d698afd59d
  • SHA512 8b60c4676d33b4a15fea8ec15292a1b2f5ec0691e5ae2ac043e8e8ce8d93cddea5e1ff1c9801fa0ccdcd5a43234ab984d8e8dfb1cf577a2a35845dd7a30abdcb
  • SSDEEP 98304:rKAQiNOI1QB5tPCM+OI9hRhagGbxfkt2yQ2nSy:r1JQxbMLRsLct02Sy
  • TLSH
    T1C4F52359E7E401F9E173E578CD838902EB727C490361EADF03A8A9A71F336909D39712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  we are badexecutiondonutloaderquasarloadermodulepersistenceratspywaretrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables manipulated with Fody

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2