General
- Target 2026-07-20_7fc5564816832b8778961b4f02a77bd3_akira_icedid_rusty-stealer
- Size 5.6MB
- Sample260720-dez82sds5j
- SHA256 fc699d29c67368b71b19de542de5fd2d35abe2e1fbba28337220f2b1cd7cf302
Score
10/10
Malware Config
Targets
-
- Target 2026-07-20_7fc5564816832b8778961b4f02a77bd3_akira_icedid_rusty-stealer
- Size 5.6MB
- SHA256 fc699d29c67368b71b19de542de5fd2d35abe2e1fbba28337220f2b1cd7cf302
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
UPX dump on OEP (original entry point)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1