57d3624ef4c299c8f98fb6172000ab2ea571007e3c3ce6caecbc54f4f3c4ba00

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
Size 2.7MB
Sample260718-blm6ysbv8l
SHA256 57d3624ef4c299c8f98fb6172000ab2ea571007e3c3ce6caecbc54f4f3c4ba00
MD5 1765dd25f6d74c45ec7204c6cd10e883
SHA1 558bb887c4a2e2b60a5c92f93bb831afc629cdfb
SHA512 849c35a80ccb5ed59d33d952fa1bbf92058046f1ee703eb39ab0065760019ea54fe8f42eb67d69f71c274922ecf3ee4f42bd2c008aaba3dc93eeefb0268efe28
SSDEEP 49152:xDqLXzWpBZEusDYg0g2kx0IU6ie8mQhm:wLDWpBwD0g2q+e8
TLSH
T159D58D13E1D540E8D4AEC078D7169633AA72B8DD0A34B6AB1BF05A112F7AFD06F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
2984	2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_1765dd25f6d74c45ec7204c6cd10e883_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads