0502c52d41498198695f3bdcf86b99cc5b5c88c9bb788b8e826a227ab0339fce

Analysis

max time kernel
150s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 02:35

Target
2026-08-12_5491a37a14da019a523595e0f7ff3a4a_akira_rusty-stealer.exe
Size 137KB
Sample260812-c2187atxcv
SHA256 0502c52d41498198695f3bdcf86b99cc5b5c88c9bb788b8e826a227ab0339fce
MD5 5491a37a14da019a523595e0f7ff3a4a
SHA1 9e26ca9ab3dcfa54178fb796f74bfab70f14769a
SHA512 03611df74311f674901dac82113d3d4d923dec3afdbed5c5c34caaeeb4110a426d70af89ff37530d5323b4c7987f99d6a833717b8f789f2f43a8974548cb4f62
SSDEEP 3072:62qoAZbdMEKCn9o+bluycomN7MXqA39AdhI:5mPznxpfco47MXq89iI
TLSH
T19DD37D13BD5161B8D00AC078871596B2BB363DE90B226DFF13A462742F99BD63F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Suspicious use of AdjustPrivilegeToken 3 IoCs

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-12_5491a37a14da019a523595e0f7ff3a4a_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5491a37a14da019a523595e0f7ff3a4a_akira_rusty-stealer.exe"
1⤵
PID:5312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5392