e5f5730e4297de246ae929f8ff64132eeaf7719ab2a7cd78b598b9978d490fc9

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:10

Target
2026-05-28_33c0164f44ac3cda8127ab97f76fdbca_akira_rusty-stealer.exe
Size 1.1MB
Sample260528-bjszesew3v
SHA256 e5f5730e4297de246ae929f8ff64132eeaf7719ab2a7cd78b598b9978d490fc9
MD5 33c0164f44ac3cda8127ab97f76fdbca
SHA1 da517ce0d9a39f71cb6bd8015f24f054ee692625
SHA512 399a816def39b7a89b190bb8538361661412eaf5b06c5eb00cb3408c48b580d4f40e2f6aae44c095b61581b2737f7d8d64ff2a1efdbb893c45bd4f19594d71d5
SSDEEP 24576:/2Z0A7586bd+UnwIIrovc7PZoIt4fPItxqCmNQ1clgRxNYy:/A0A1rWPraiKi4fPItMaGgXNYy
TLSH
T1D645F126F94799E8D44AC4B5C3468973B93634DA0B32B9FF02D445383F5ABE46B38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x002100000002b234-2.dat	UPX
behavioral2/memory/3240-3-0x00007FF625DD0000-0x00007FF62600B000-memory.dmp	UPX
behavioral2/memory/3240-6-0x00007FF625DD0000-0x00007FF62600B000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
3240	403750959348f81fffee825d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x002100000002b234-2.dat	upx
behavioral2/memory/3240-3-0x00007FF625DD0000-0x00007FF62600B000-memory.dmp	upx
behavioral2/memory/3240-6-0x00007FF625DD0000-0x00007FF62600B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3240	952	2026-05-28_33c0164f44ac3cda8127ab97f76fdbca_akira_rusty-stealer.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-28_33c0164f44ac3cda8127ab97f76fdbca_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_33c0164f44ac3cda8127ab97f76fdbca_akira_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\403750959348f81fffee825d.exe
  "C:\Users\Admin\AppData\Local\403750959348f81fffee825d.exe"
  2⤵
  - Executes dropped EXE
  PID:3240

403750959348f81fffee825d.exe

Path C:\Users\Admin\AppData\Local\403750959348f81fffee825d.exe
Size 881KB
SHA256 14051fe68a07882c20d7bd94e7dbba79aaad376d07fbe9777493ed428fa177e1
MD5 41cf42475f23a654605d4d606f1259a9
SHA1 f3175d13b6ab05d95d0c9ceee868d74f4d9a4142
SHA512 4ebc830f80a50ebcc45285934d2a340b98562fae2d24d500479ee36cad6b1cc275c2da495d01f3c6c1b3c9f3ec9204d6668d06c42acbb1dd9dc6417ff4c97aa8
SSDEEP 24576:ZpvIMPJHV8h8h5z/v9oBVimyleSeGhdTwh:Zpzx1hhJ8imyleSeoo
TLSH
T13E1523E8D05203A6F5F9E3F4EC113A90661F3163C0896D605E99FACAE0F82F49EDD552
MD5 SHA1 SHA512 SSDEEP TLSH