db7ee611415537ce004fa5778c907c064edb7ae12e6cf4f83956c69e197d304b

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:46

Target
2026-09-04_1f81dc7c0dab766194070a6014c4d666_akira_rusty-stealer.exe
Size 134KB
Sample260905-vacevsfk31
SHA256 db7ee611415537ce004fa5778c907c064edb7ae12e6cf4f83956c69e197d304b
MD5 1f81dc7c0dab766194070a6014c4d666
SHA1 83d09f75580c82a72cc2bc537816f6c4a80bbec3
SHA512 7e2eb70b3688bb933a3429b08742040ef6becc62633f838f9130637adcb2a89f7829f8b4ae0d9490b7d3738b8edbd09aba2490dfc33f9a17c102e7920c425930
SSDEEP 1536:f0saCAVEPxqezh1ME9eroFR0wkmfNPTJ77DDl+cugQ5KCm8TjReM5m9RJOzYlx4V:IFeZtfME00cGBccO68Tt5mtrlx4Ir6
TLSH
T103D38E13B65171B9D40AC17C83159572B73B78C40B227AFF53A922382F26AEA3F39714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Suspicious use of AdjustPrivilegeToken 3 IoCs

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-04_1f81dc7c0dab766194070a6014c4d666_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1f81dc7c0dab766194070a6014c4d666_akira_rusty-stealer.exe"
1⤵
PID:2312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4144