63f0b12aa8668a0d169e767963cd42ac6c3e42b34b10235ae6d2e83354c5187e

General

Target
2026-05-23_ecaa97d905bf180ca195fae8d2f08994_akira_icedid_rusty-stealer_ryuk
Size 7.7MB
Sample260523-pc4dgab18x
SHA256 63f0b12aa8668a0d169e767963cd42ac6c3e42b34b10235ae6d2e83354c5187e
MD5 ecaa97d905bf180ca195fae8d2f08994
SHA1 f64e3aeb5fa376f633fc47210ff8f0075fb777c4
SHA512 f04de8dabc8c4e30bc5ca9f0d425f590dbde39a8187a3054ad7be552720bd75d0238526a45ca8b84cc96759078d0d5c8a9940bf9b87c14b7388a183968b08a95
SSDEEP 196608:jySytO9INTx/7ns0XHAjPePhjtSwRlN5/:ORtO9IjqGX/
TLSH
T1A686DF0D553790A8CC129DFCAB73F8FF7A54A1AE0EB4425A11DB1CB0E728E2B45995F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-05-23_ecaa97d905bf180ca195fae8d2f08994_akira_icedid_rusty-stealer_ryuk
- Size 7.7MB
- SHA256 63f0b12aa8668a0d169e767963cd42ac6c3e42b34b10235ae6d2e83354c5187e
- MD5 ecaa97d905bf180ca195fae8d2f08994
- SHA1 f64e3aeb5fa376f633fc47210ff8f0075fb777c4
- SHA512 f04de8dabc8c4e30bc5ca9f0d425f590dbde39a8187a3054ad7be552720bd75d0238526a45ca8b84cc96759078d0d5c8a9940bf9b87c14b7388a183968b08a95
- SSDEEP 196608:jySytO9INTx/7ns0XHAjPePhjtSwRlN5/:ORtO9IjqGX/
- TLSH
  T1A686DF0D553790A8CC129DFCAB73F8FF7A54A1AE0EB4425A11DB1CB0E728E2B45995F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2