General
- Target 2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm
- Size 1.6MB
- Sample260518-e8ls7abw9j
- SHA256 799de201f385f7181a24dc071001c5cc7a86b8452477ba8066482ad85fd54823
Malware Config
Targets
-
- Target 2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm
- Size 1.6MB
- SHA256 799de201f385f7181a24dc071001c5cc7a86b8452477ba8066482ad85fd54823
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing combination of virtualization drivers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing virtualization MAC addresses
-
Looks for VirtualBox drivers on disk
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare drivers on disk
-
Deletes itself
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Registers new Windows logon scripts automatically executed at logon.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1