General
- Target 2026-07-12_858fb46667b45471699ad56a82bc1711_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk
- Size 2.5MB
- Sample260712-ppfg6sby7t
- SHA256 575aa9966b5997e907e26513fe62d4a55fc273b05351731a832cd33fa6c232a6
- MD5 858fb46667b45471699ad56a82bc1711
- SHA1 80a1a171de7654ae3d12ef526171a4651c2b53b5
- SHA512 c278d0ffff99017c51160ea081cd3dd1f69576349d25dc8101d91a2b7abde74c7cc8997bd250891f3dbb535c53e348c651fa80c9a214d629c88b715fa8d41f56
- SSDEEP 49152:IcZZg+rxZq6b46Aw76LTS2dIU6ie8UrhJ:IMr2Rw76Lxq+e8
- TLSH T1B9C59E13E1D140E8D4EEC078D71A5A32BA72B8DD4A34B6AF1BD44A112E76FD06F2DB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_858fb46667b45471699ad56a82bc1711_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_858fb46667b45471699ad56a82bc1711_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_858fb46667b45471699ad56a82bc1711_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk
- Size 2.5MB
- SHA256 575aa9966b5997e907e26513fe62d4a55fc273b05351731a832cd33fa6c232a6
- MD5 858fb46667b45471699ad56a82bc1711
- SHA1 80a1a171de7654ae3d12ef526171a4651c2b53b5
- SHA512 c278d0ffff99017c51160ea081cd3dd1f69576349d25dc8101d91a2b7abde74c7cc8997bd250891f3dbb535c53e348c651fa80c9a214d629c88b715fa8d41f56
- SSDEEP 49152:IcZZg+rxZq6b46Aw76LTS2dIU6ie8UrhJ:IMr2Rw76Lxq+e8
- TLSH T1B9C59E13E1D140E8D4EEC078D71A5A32BA72B8DD4A34B6AF1BD44A112E76FD06F2DB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.