Extracted

• • Target
    2026-10-22_779bf1ac1f6035f7429dd4adad239d0c_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 48.3MB
  • SHA256 7ccb4421563e36b61383e6a80432b5a593a25ef1cce555353690d2f4d8a136cd
  • MD5 779bf1ac1f6035f7429dd4adad239d0c
  • SHA1 70e7b356cfef9c1eee296a5b6c08efc7b36b04e6
  • SHA512 c9f9e39aed3c2b0c574cd3e8783c106ad121e986cf3fc4d41b81aff0f35e558c8a1815aff082d07a03481404fcdb215a3c5c3e00e68563a9c2d5a5b7a4c31f78
  • SSDEEP 786432:Mo2IsD+3o8M7lYgAnbuckt3+Sy/PTLBvf9aJSjf2/0zN6PvyV4mvR:Mo2IwioTZJaT2ORTWJsfFiOdp
  • TLSH
    T1B6B73311FB9804BDE1E6E8B48ADA840793F6B80A47F1980F53DC76A65F377408D35B98
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aalloodiscoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2