Extracted

Extracted

• • Target
    2026-10-05_44292b2644b29afe15d982aa2107d331_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 20.2MB
  • SHA256 69b2ae35f3f0133f2b1ce37981ea009204669a53f8d0a139baad7821d99afb35
  • MD5 44292b2644b29afe15d982aa2107d331
  • SHA1 2385bd511185acb9f52b69bcf4675ab09da5ac24
  • SHA512 73c51f5829d08b389320ce98fedf46aa8e38576f5fff73ff124b778c4d9ce16f370cf2f1b03398883331a1727a163e77af8628cf950bba33a0393f967f10579c
  • SSDEEP 393216:B9LS3zmj8a1g/FeHabL97FmSIxOEJva+P8B9PBJ:BwaIaWmabL1FmfOMvCBJ
  • TLSH
    T1D8273302FBE401BCF0E3E5748453EA55E763FC698775E28F562CAB824F67540883AB91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  newdefense_evasiondiscoveryexecutionquasarinstallerlinkpdfpersistenceprivilege_escalationransomwarespywarestealertrojanupx

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects command variations typically used by ransomware

  • Detects executables containing common artifacts observed in infostealers

  • UPX dump on OEP (original entry point)

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2