93fa5225db652b4511f0c6ec13c55b74680bde9133380c945ea8208873522ef6

General

Target
2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk
Size 10.8MB
Sample260522-cm8dyscv3l
SHA256 93fa5225db652b4511f0c6ec13c55b74680bde9133380c945ea8208873522ef6
MD5 1ef0239461e56f4bd4c9c62c63424528
SHA1 60219a2f69c43c9daa2dbe52c49f9e92c23c774e
SHA512 91254e8835f896431d20a9409a4eff4c767ca9958bc804e40fa3010b95d715b99ddd6152ee3cde0be97201815ce66308e6fbecb20bf3e982e24f1e966d732dd2
SSDEEP 196608:gJMlaJczJAT5rg7VgfKUXt+bq0c3o8YuQoYbOw:2pcuryVgfKi93PVYx
TLSH
T1A5B6DF31C5087FB8D45A813D23AFD70D567BF7A146B31EC9E1947B82405BAE2BE0906E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk
- Size 10.8MB
- SHA256 93fa5225db652b4511f0c6ec13c55b74680bde9133380c945ea8208873522ef6
- MD5 1ef0239461e56f4bd4c9c62c63424528
- SHA1 60219a2f69c43c9daa2dbe52c49f9e92c23c774e
- SHA512 91254e8835f896431d20a9409a4eff4c767ca9958bc804e40fa3010b95d715b99ddd6152ee3cde0be97201815ce66308e6fbecb20bf3e982e24f1e966d732dd2
- SSDEEP 196608:gJMlaJczJAT5rg7VgfKUXt+bq0c3o8YuQoYbOw:2pcuryVgfKi93PVYx
- TLSH
  T1A5B6DF31C5087FB8D45A813D23AFD70D567BF7A146B31EC9E1947B82405BAE2BE0906E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables packed with VMProtect.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2