General
- Target 2026-06-25_e4eec8e56c3e899ac82e590dd7b1902f_akira_icedid_rusty-stealer
- Size 15.6MB
- Sample260629-xy9rdaew2l
- SHA256 be09caaf4fed06f19bd40dbfab3445caa1830e74ddafe878027152f12a9432cf
Score
10/10
Malware Config
Targets
-
- Target 2026-06-25_e4eec8e56c3e899ac82e590dd7b1902f_akira_icedid_rusty-stealer
- Size 15.6MB
- SHA256 be09caaf4fed06f19bd40dbfab3445caa1830e74ddafe878027152f12a9432cf
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Custom signature
Detect binaries embedding considerable number of MFA browser extension IDs.
- Custom signature
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger