f1f0adbe9bced10937150b24fc0f7ec822b1214966de2a381d9b7ff538419ab1

General

Target
2026-05-28_ea584e172cb80d6090fc63c280780449_akira_cobalt-strike_glassworm_icedid_luca-stealer_remcos_rusty-stealer_satacom
Size 109.7MB
Sample260528-ls9cwact4n
SHA256 f1f0adbe9bced10937150b24fc0f7ec822b1214966de2a381d9b7ff538419ab1
MD5 ea584e172cb80d6090fc63c280780449
SHA1 5572cc8e2f38cd49566d57bc3bc7fdc980f35a08
SHA512 2c3c52bce1a0de4a66655dc1e78e912ea66e5cddf96fe183b389277948fe5777e8458c5d1a461f7051380772b2e4fa147b925ba8eaa4453c9897899e7f499e9a
SSDEEP 3145728:KMqToPIi0zVGayIY3RF0e8BAv5kdHXaa:KMqToPP0eCBSkpXa
TLSH
T1D0482345FA5A9568E09AC87492030A934F2130EB163BE8FF51D561283F9B7F44F3D36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-28_ea584e172cb80d6090fc63c280780449_akira_cobalt-strike_glassworm_icedid_luca-stealer_remcos_rusty-stealer_satacom
- Size 109.7MB
- SHA256 f1f0adbe9bced10937150b24fc0f7ec822b1214966de2a381d9b7ff538419ab1
- MD5 ea584e172cb80d6090fc63c280780449
- SHA1 5572cc8e2f38cd49566d57bc3bc7fdc980f35a08
- SHA512 2c3c52bce1a0de4a66655dc1e78e912ea66e5cddf96fe183b389277948fe5777e8458c5d1a461f7051380772b2e4fa147b925ba8eaa4453c9897899e7f499e9a
- SSDEEP 3145728:KMqToPIi0zVGayIY3RF0e8BAv5kdHXaa:KMqToPP0eCBSkpXa
- TLSH
  T1D0482345FA5A9568E09AC87492030A934F2130EB163BE8FF51D561283F9B7F44F3D36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Custom signature
  
  Detects executables (downlaoders) containing URLs to raw contents of a paste
- Custom signature
  
  Detects executables referencing combination of virtualization drivers
- Modifies Windows Firewall
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2