Extracted

• • Target
    2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 45.4MB
  • SHA256 8266069f6262404194219a6c8cf6cf323f4792c81e22cdc91f2e268600b9882c
  • MD5 6d8e286cb2519171ae25afda3bdccbd3
  • SHA1 cfe05a4ebd04d3d1755c7a286bdd576c918629fd
  • SHA512 8fa5b27992254da4819e96f91a3ab1d722ea44f3ae975173e3192f5549296e00635941d7e012eaa04aa1efa363e7a47a8d5a8e555aa115eacfa0154551b66c5b
  • SSDEEP 786432:uqzbS4ce2s7N+OWrhsqP6bxW2m/vn7iKmlgcfVU6PYAyjxZNziHVB/onPnHvlfgk:uqq4f/gOWrfP6mn7vmlgcq6UM/Ugwhz
  • TLSH
    T107A73390FD4292FBE8F7D13568BFA092D612B657476292FF07480BA4196B1D4DE38B30
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcollectioncredential_accessdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationpyinstallerratspywarestealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects executables attemping to enumerate video devices using WMI

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2