General
- Target 2026-04-20_8aa9bf2ff4c0d61852df8254579f0c60_akira_cobalt-strike_glassworm_quasar-rat
- Size 1.9MB
- Sample260420-1pcbasgv9s
- SHA256 c1424e889772374c8ce8cd64b591a4a6b1df98ef469f6d66cb920e837b19c896
Score
8/10
Malware Config
Targets
-
- Target 2026-04-20_8aa9bf2ff4c0d61852df8254579f0c60_akira_cobalt-strike_glassworm_quasar-rat
- Size 1.9MB
- SHA256 c1424e889772374c8ce8cd64b591a4a6b1df98ef469f6d66cb920e837b19c896
Score8/10Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3