2bc6d94d53a8801b459c6fcb2ff12d4db913e3a198866bfc9838f583760b33ba

General

Target
2026-04-15_689f08f3ab8e1089dabbb87dd77531cc_akira_glassworm_icedid_rusty-stealer
Size 2.3MB
Sample260415-fljwrae16j
SHA256 2bc6d94d53a8801b459c6fcb2ff12d4db913e3a198866bfc9838f583760b33ba
MD5 689f08f3ab8e1089dabbb87dd77531cc
SHA1 e8775960e9c05541288a8b672bb680622f7e2d9f
SHA512 cce8f0d8929a352f55404fb2bbfb62d2f5ae0742e437e1ab5dd85e700960cab57807b698cb0731c1d2d1b384d1c9038d2f44955c77e9b32e08feb941e5433598
SSDEEP 49152:nqRWfTUT2h7MZpf4EPCX7gGPOi2WTtMj8FFqlPrEG4Y:yNPdti2WSP34
TLSH
T181B54B13B6B690F8C55AC074D31A5632BB32B88A07313AFB26D84A253F65FD06B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-15_689f08f3ab8e1089dabbb87dd77531cc_akira_glassworm_icedid_rusty-stealer
- Size 2.3MB
- SHA256 2bc6d94d53a8801b459c6fcb2ff12d4db913e3a198866bfc9838f583760b33ba
- MD5 689f08f3ab8e1089dabbb87dd77531cc
- SHA1 e8775960e9c05541288a8b672bb680622f7e2d9f
- SHA512 cce8f0d8929a352f55404fb2bbfb62d2f5ae0742e437e1ab5dd85e700960cab57807b698cb0731c1d2d1b384d1c9038d2f44955c77e9b32e08feb941e5433598
- SSDEEP 49152:nqRWfTUT2h7MZpf4EPCX7gGPOi2WTtMj8FFqlPrEG4Y:yNPdti2WSP34
- TLSH
  T181B54B13B6B690F8C55AC074D31A5632BB32B88A07313AFB26D84A253F65FD06B3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Renames multiple (625) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2