1a1248058addedfbe59ba3f3a9117df87d4cab9ea5e11ed72820e8c960624db1

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Size 2.7MB
Sample260718-3p2mash131
SHA256 1a1248058addedfbe59ba3f3a9117df87d4cab9ea5e11ed72820e8c960624db1
MD5 ced36cb3244524ac19a0613bc519293a
SHA1 ac43e42ec90f8a16b928cb811b15bd71e4409073
SHA512 bca19710c5e787b811dd07cbfbdb8580ea93eddd3c5a62513fcf82adc737a7b300f1826c060ebecb935f35becf1d8a96f9e0ef1a0e1cf9959525df840350a670
SSDEEP 49152:QGGvHXzWpBZEusDYg0g2Gx7IU6ie8mQhm:mfDWpBwD0g2L+e8
TLSH
T139D58D13E1D540E8D4AEC078D7169633AA72B8DD0A34B6AB1BF05A112F7AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
1856	2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_ced36cb3244524ac19a0613bc519293a_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads