General
- Target 2026-08-03_4c19aa6da704cb776a5d109965971a5c_akira_glassworm_ngrbot_rusty-stealer
- Size 4.0MB
- Sample260804-n84tfadr9z
- SHA256 db2f0c6a578d9cfa4e0066d67bae77bfaa3adda38797434c9d4a0eef86bb9118
Score
10/10
Malware Config
Targets
-
- Target 2026-08-03_4c19aa6da704cb776a5d109965971a5c_akira_glassworm_ngrbot_rusty-stealer
- Size 4.0MB
- SHA256 db2f0c6a578d9cfa4e0066d67bae77bfaa3adda38797434c9d4a0eef86bb9118
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Disables automatic submission of suspicious files to Microsoft by Windows Defender
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.