667ae1f9cca7d0c614e673bd08ac1d0fc408217244cc1ac0f2ee0e2b1ccdfe6e

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:29

Target
2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
Size 6.0MB
Sample261006-v2thfsswd1
SHA256 667ae1f9cca7d0c614e673bd08ac1d0fc408217244cc1ac0f2ee0e2b1ccdfe6e
MD5 aa91be72af25a0f3cafc3242983ac068
SHA1 0e7b36b8035dba9ed0f1f4289bb6759089e1a673
SHA512 31ed013f0e55e8595ec547bdc81477e654b0ffd3eca7e957fada1f2c48958303451104db7261ac993768f52988c206216978b95ac9e90f734e82e4024c849ad9
SSDEEP 49152:j/3ajqfpjyE5pQ0Hk7ZMrHhl8+YP8MnWSsnBeiAwgJuNmEHjRfe3bbIyxWbRhwpV:rHg8UiYLz78a
TLSH
T19056A42A6669A0DDC17BC0B8D2878F62A92174DD0B393BF345D182792F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 5896	5228	2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Users\Admin\AppData\Local\Temp\2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer.exe" --exact scheduler::tests::native_child_process --ignored --nocapture
  2⤵
  PID:5896