General
- Target 2026-07-14_ca624cca0903e2de34f144ec49d4303e_akira_icedid_rusty-stealer
- Size 3.4MB
- Sample260714-dh4ewafs5w
- SHA256 7d5c13f7f7e7e622dde20efda6a2174a69b832e2fcc8be60804d5bee2ff334e8
Score
10/10
Malware Config
Targets
-
- Target 2026-07-14_ca624cca0903e2de34f144ec49d4303e_akira_icedid_rusty-stealer
- Size 3.4MB
- SHA256 7d5c13f7f7e7e622dde20efda6a2174a69b832e2fcc8be60804d5bee2ff334e8
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Custom signature
Detect binaries embedding considerable number of MFA browser extension IDs.
- Custom signature
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger