General
- Target 2026-06-30_211589200e5cacf3e2bb35a2852bad94_akira_quasar-rat
- Size 1.9MB
- Sample260701-ahr53act6v
- SHA256 e461175a697384d8304fd2883bb2c6bba45a15b140a0aa3693693be4bf7aff91
Score
10/10
Malware Config
Targets
-
- Target 2026-06-30_211589200e5cacf3e2bb35a2852bad94_akira_quasar-rat
- Size 1.9MB
- SHA256 e461175a697384d8304fd2883bb2c6bba45a15b140a0aa3693693be4bf7aff91
Score10/10-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies Windows Firewall
-
Disables service(s)
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1