Extracted

• • Target
    2026-10-21_a6fe40719e5ec6e3e7b6a0291558c681_glassworm_icedid_luca-stealer_njrat
  • Size 2.0MB
  • SHA256 93433b66b307aa2a3ecfeef84cf9180b26656280e3e6c0adf7d125f1877ccff6
  • MD5 a6fe40719e5ec6e3e7b6a0291558c681
  • SHA1 8907821e991d4d2602da8805c206fa72089219f5
  • SHA512 18ace307c6f1c4d5d5f3dbc03f4ff5ae5bcd077de31a22f9cea1fd6169af9c266b4f1df2fb2a401e4593195bddb926ba82fb62ac1bb54aecad8e59b9b9039f88
  • SSDEEP 24576:25uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:mno8haujVsPAB8KY2+Bz+2
  • TLSH
    T165A58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverysiriusratpersistencerat

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat
  • Custom signature

    Detect binaries embedding considerable number of MFA browser extension IDs.

  • Custom signature

    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects command variations typically used by ransomware

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables containing artifacts associated with disabling Widnows Defender

  • Custom signature

    Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Custom signature

    Detects executables referencing many Password Manager software clients. Observed in infostealers

  • Custom signature

    Detects executables referencing many email and collaboration clients. Observed in information steale

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2