cybrexagent | 992145799f356cc1493924b659f2e86b76e709e6cf5d88ba1c543c6060f49131

General

Target
2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe
Size 14.3MB
Sample260802-aw4q1sap21
SHA256 992145799f356cc1493924b659f2e86b76e709e6cf5d88ba1c543c6060f49131
MD5 66d5d9176b37dc6ae366a2a58bfbca72
SHA1 1ca667bbc45e1f9e0f4674ef7dad672fbc4e05ac
SHA512 2dc0ff82245c1c9a6eb4e6aa3b5a20a65ab888816200e3e739ac1ffaca59332b57a37607533392d48cc384ccd90dc8643ee87a6e9434891482c38fe7251de141
SSDEEP 98304:FS6+5F91L9bvOzQnFdPy9qs+fr9X5FippDyEpYo2BTpjwhR8pb2fYR2Di61M6uyY:c6AysxySgyEpQtsvMwq27e6v9qG2vr
TLSH
T1D5E66C16FAAA54ECC45AC474C2564A23AA3174CA0B34BAFF45C496783F7ABF05E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution cybrexagent persistence privilege_escalation stealer

Malware Config

Signatures

Family: CybrexAgent
CybrexAgent is a Windows stealer written in Rust.
stealer cybrexagent

Detects CybrexAgent 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c54c-0.dat	family_cybrexagent

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c54c-0.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Admin.vbs	CybRex_Agent_Secure.exe

Executes dropped EXE 2 IoCs

pid	Process
4880	CybRex_Agent_Secure.exe
2692	installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2692	installer.exe
2692	installer.exe
2692	installer.exe
2692	installer.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1848	tasklist.exe
4068	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4136	cmd.exe
256	cmd.exe
5864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4136	1096	2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe	89
PID 1096 wrote to memory of 256	1096	2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe	91
PID 256 wrote to memory of 4880	256	cmd.exe	93
PID 4880 wrote to memory of 2692	4880	CybRex_Agent_Secure.exe	94
PID 4880 wrote to memory of 5864	4880	CybRex_Agent_Secure.exe	95
PID 5864 wrote to memory of 1648	5864	cmd.exe	97
PID 2692 wrote to memory of 1848	2692	installer.exe	98
PID 2692 wrote to memory of 4068	2692	installer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c copy /Y C:\Users\Admin\AppData\Local\Temp\2026-08-01_66d5d9176b37dc6ae366a2a58bfbca72_akira_cloudeye_glassworm_icedid_luca-stealer_rusty-stealer.exe C:\Users\Admin\AppData\Local\CybRex_Agent_Secure\CybRex_Agent_Secure.exe
  2⤵
  - Executes a command shell one-liner
  PID:4136
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start "" C:\Users\Admin\AppData\Local\CybRex_Agent_Secure\CybRex_Agent_Secure.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Users\Admin\AppData\Local\CybRex_Agent_Secure\CybRex_Agent_Secure.exe
    C:\Users\Admin\AppData\Local\CybRex_Agent_Secure\CybRex_Agent_Secure.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq webcam.exe" /NH
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq IriunWebcam.exe" /NH
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4068
  - - C:\Windows\system32\cmd.exe
      "cmd" /C "reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\Windows\system32\reg.exe
        
        reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CybRex_Agent_Secure.exe

Path C:\Users\Admin\AppData\Local\CybRex_Agent_Secure\CybRex_Agent_Secure.exe
Size 14.3MB
SHA256 992145799f356cc1493924b659f2e86b76e709e6cf5d88ba1c543c6060f49131
MD5 66d5d9176b37dc6ae366a2a58bfbca72
SHA1 1ca667bbc45e1f9e0f4674ef7dad672fbc4e05ac
SHA512 2dc0ff82245c1c9a6eb4e6aa3b5a20a65ab888816200e3e739ac1ffaca59332b57a37607533392d48cc384ccd90dc8643ee87a6e9434891482c38fe7251de141
SSDEEP 98304:FS6+5F91L9bvOzQnFdPy9qs+fr9X5FippDyEpYo2BTpjwhR8pb2fYR2Di61M6uyY:c6AysxySgyEpQtsvMwq27e6v9qG2vr
TLSH
T1D5E66C16FAAA54ECC45AC474C2564A23AA3174CA0B34BAFF45C496783F7ABF05E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\installer.exe
Size 2.6MB
SHA256 bbbe98d5acb43c1f2c4ec196d15e48f1ca469446c4c17c5819162a71694e131d
MD5 9dd56b8032f1cb4a6b0465249a6ca267
SHA1 8ff5247668f656c3f6d23e6447adaffc03100403
SHA512 491f59538a2d72cd413ab58c932ce95207d09e4c6be29858497b2a364fa704352176df8c8d23ab0a5140600e83f891e0c72baea0f013ac9169c0f978a0e2f208
SSDEEP 49152:LjDiB2caUR8vxb2fXydxtRlR6Diet1Yff6uAP9nqG2pgJo4rrekCopny:LjwhR8pb2fYR2Di61M6uy9qG2mJfWRo0
TLSH
T11EC53328FB61C551E45B523380B376FBA2176DF782A445233798FD0B64722B26CE6B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8A08.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8A08.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8A08.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads