General
- Target 2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat
- Size 3.3MB
- Sample260522-eterbsg16z
- SHA256 1908667a279616de082f9f3a196fc1710ce5be9c85bdb2fe7100192f4d8d42f2
Score
10/10
Malware Config
Targets
-
- Target 2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat
- Size 3.3MB
- SHA256 1908667a279616de082f9f3a196fc1710ce5be9c85bdb2fe7100192f4d8d42f2
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Deletes itself
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery
Attempt to gather information on host's network.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1