General
- Target 2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc
- Size 4.6MB
- Sample260714-d45j3adv6m
- SHA256 db29e8a8465bd7f89f0d16197411deae8afd55b63ba701de3465b4915de9c620
Score
10/10
Malware Config
Targets
-
- Target 2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc
- Size 4.6MB
- SHA256 db29e8a8465bd7f89f0d16197411deae8afd55b63ba701de3465b4915de9c620
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables service(s)
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3