e027138863f7ad9278935f1736913eb24a0f46bd766b62500e97cb661f9a89e9

General

Target
2026-05-22_3f0f29fbe7d9eb01b19a4f97660d63e7_akira_cobalt-strike_glassworm_icedid_luca-stealer_remcos_rusty-stealer_satacom
Size 113.5MB
Sample260522-27zd8aaw2w
SHA256 e027138863f7ad9278935f1736913eb24a0f46bd766b62500e97cb661f9a89e9
MD5 3f0f29fbe7d9eb01b19a4f97660d63e7
SHA1 50aa4482562d618898de8d133912892b40c1700a
SHA512 7cd2f5f2ca0918ba4720b0d6a2814c5825942946b85c830358412959ab5c9f0d74461a240c1f68178ab16990d885344dd14ae861f2eb9ed8bc07d19780a62046
SSDEEP 3145728:AToRX4XT0T+23KWGS0zPyIY3RFKe8BAv+xZo:AToJ4j0TnK+0+oB
TLSH
T1C1482341FB5A5539E09AC87492030A534F2234EB1636E8FB51D560283F9B7F85F3A36E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-22_3f0f29fbe7d9eb01b19a4f97660d63e7_akira_cobalt-strike_glassworm_icedid_luca-stealer_remcos_rusty-stealer_satacom
- Size 113.5MB
- SHA256 e027138863f7ad9278935f1736913eb24a0f46bd766b62500e97cb661f9a89e9
- MD5 3f0f29fbe7d9eb01b19a4f97660d63e7
- SHA1 50aa4482562d618898de8d133912892b40c1700a
- SHA512 7cd2f5f2ca0918ba4720b0d6a2814c5825942946b85c830358412959ab5c9f0d74461a240c1f68178ab16990d885344dd14ae861f2eb9ed8bc07d19780a62046
- SSDEEP 3145728:AToRX4XT0T+23KWGS0zPyIY3RFKe8BAv+xZo:AToJ4j0TnK+0+oB
- TLSH
  T1C1482341FB5A5539E09AC87492030A534F2234EB1636E8FB51D560283F9B7F85F3A36E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Custom signature
  
  Detects executables (downlaoders) containing URLs to raw contents of a paste
- Custom signature
  
  Detects executables referencing combination of virtualization drivers
- Modifies Windows Firewall
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2