2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk
Size 1.1MB
Sample261030-e32x8avzht
SHA256 07271ee4bf7ca2649627b486ec7ef1ee8536b553ca94c46d609eda4e52fd7740
MD5 5415717b00e9a476a359de9bd886ed57
SHA1 8001b7af00316cf980d0ac53c4af6cc36f1d5bd8
SHA512 87e2b289bbae53d7772e9630ac8835a15114fc9dca2e237026486e745d28d04f08c78cbbaa554837afb57663912a1262da813c7e174f8537dfd2943bd26cd98c
SSDEEP 12288:GOMtKmH4+MfDs41Y2JLLCjZbYjjLhk6LZCta+Rul+Tz0+Tg+Tx20+T:GOMtEQq7JLLCNkLe6LZwYoz0ogox20o
TLSH
T176359D02B6A291FCD05AC076C2155A73BA72788A0B31BEFB139446353F65BE51F3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk

File Explorer

2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk

.exe 1.1MB

2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk

IMPHASH 538d9048c42cfabf1c0cd707534fa44b
SHA256 07271ee4bf7ca2649627b486ec7ef1ee8536b553ca94c46d609eda4e52fd7740
MD5 5415717b00e9a476a359de9bd886ed57
SHA1 8001b7af00316cf980d0ac53c4af6cc36f1d5bd8
SHA512 87e2b289bbae53d7772e9630ac8835a15114fc9dca2e237026486e745d28d04f08c78cbbaa554837afb57663912a1262da813c7e174f8537dfd2943bd26cd98c
SSDEEP 12288:GOMtKmH4+MfDs41Y2JLLCjZbYjjLhk6LZCta+Rul+Tz0+Tg+Tx20+T:GOMtEQq7JLLCNkLe6LZwYoz0ogox20o
TLSH
T176359D02B6A291FCD05AC076C2155A73BA72788A0B31BEFB139446353F65BE51F3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

171992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Snowhush_Setup.pdb

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateMutexA CreateWaitableTimerExW DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MoveFileExW MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile lstrlenW

ole32

CoCreateInstance CoInitializeEx

combase

CoTaskMemFree

gdi32

CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW FindWindowW GetCursorPos GetDC GetMessageW GetMonitorInfoW GetWindowRect GetWindowThreadProcessId LoadCursorW LoadImageW MonitorFromPoint PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC SendMessageTimeoutW SetCapture SetForegroundWindow ShowWindow TranslateMessage UpdateLayeredWindow

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

GetErrorInfo

advapi32

RegGetValueW RegSetKeyValueW

ntdll

NtWriteFile RtlNtStatusToDosError

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

832KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_5415717b00e9a476a359de9bd886ed57_akira_icedid_rusty-stealer_ryuk

kernel32

ole32

combase

gdi32

user32

d2d1

dwrite

api-ms-win-shcore-scaling-l1-1-1

oleaut32

advapi32

ntdll

shlwapi

shell32

api-ms-win-core-synch-l1-2-0

generic