Extracted

• • Target
    2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat
  • Size 2.0MB
  • SHA256 2d4cb785d48a888c2542e90c51180c5279f306d15661f6ae72a14333e6f60de6
  • MD5 e4ab4a5f19ed991c16cb7e8bce6f5415
  • SHA1 c1f919b4e7ce811f7c8384476e38a082055986fc
  • SHA512 79ebdc7fe3333c8da13268054b980ca78e196706eb41d9e31ba6e3de79ebb54f1d7f4c0c049cdb61f18fa04c1688e2f7073bd88d6b825b69df8af809c2ba0a98
  • SSDEEP 24576:25uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:mno8haujVsPAB8KY2+Bz+2
  • TLSH
    T13BA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverysiriusratpersistenceprivilege_escalationrat

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects command variations typically used by ransomware

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many Password Manager software clients. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Uses Session Manager for persistence

    Creates Session Manager registry key to run executable early in system boot.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2