Extracted

• • Target
    2026-07-14_aaf89493dd8e95da247734dc3604910d_akira_icedid_rusty-stealer
  • Size 2.1MB
  • SHA256 80c474154b1df816cf513ae978936875b6dd77f47ef6bce78dda83ab1b89525b
  • MD5 aaf89493dd8e95da247734dc3604910d
  • SHA1 37d602cc3032e8a6341a4ccf9e353db31ea2f803
  • SHA512 f555c71e30eff3497011e0c43f62873ef4e3cd61deeda9bc2ce79a588fbf2ccdd6fca1002f46f6d9a318b511efe06450e0f7de24c8d7742051c31238e8be2af7
  • SSDEEP 49152:HyuAicVhD4WqhYyc4snG/5UU2kNHB4uQHCu7S:HypFq3uUXGziu7S
  • TLSH
    T1DAA5D053F68685FCC02BC4B4C2564763EB71748A0B2169FF8294AA783F16AF54F38395
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionexploitimpactransomwarespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Turns off Windows Defender SpyNet reporting

    defense_evasion

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects command variations typically used by ransomware

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables containing commands for clearing Windows Event Logs

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (1426) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Disables service(s)

    defense_evasionexecution

  • Drops startup file

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Windows security modification

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2