c1bcc606f11d6e62df413db045d0339b49470a92a0c0f57fd218f96694e0c91c

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Size 2.7MB
Sample260718-bj35dsbv4p
SHA256 c1bcc606f11d6e62df413db045d0339b49470a92a0c0f57fd218f96694e0c91c
MD5 2a09e1dfeed14e4a9d2535ae1056e54e
SHA1 81a4e47c10652f85d41aebfbc448d751dfd010f4
SHA512 445b00689dc1e17a1b75697afebfafbdbe2c239698a8a3a443d96102eab6d3463c65752972bd53b55d24b01fd76b530ebbcfaaacb8d50e8aa9e501518097bd58
SSDEEP 49152:alzGR8YnvzaOrVWUO60gRvYNIU6ie8/HhG:KQHnBV0gRP+e8
TLSH
T141D58D13E1D540E8D4AEC078D7169633AA72B8DD0A34B6AB1BF05A112F7AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
2960	2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2a09e1dfeed14e4a9d2535ae1056e54e_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads