0139bb6bd4d6b59fbe4e8554845361a9483ff71f71c0214072b04d42a2fa6026

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Size 2.7MB
Sample260718-bk6lxaft21
SHA256 0139bb6bd4d6b59fbe4e8554845361a9483ff71f71c0214072b04d42a2fa6026
MD5 1d92a7c12927770a23a90771e523be37
SHA1 83ef2375be5d9b1e58b7cac217753266c72b63b9
SHA512 62c5b1d1030a7a3305b988b7162108a4d8376d9e4e5cda70dbbf0f7baa995b4513cd90c461d173ed9057154fb6a6365d9247f1e92e0cca222b61d7923efe4d9f
SSDEEP 49152:pVA3rdosXOYyCbFZY0gdL72IU6ie88HhWW:HA3rFXJQ0gdh+e8K
TLSH
T116D58D13E1D540E8D4AEC078D7169633AA72B8DD0A34B6AB1BF05A112F7AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
1140	2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads