General
- Target 2026-06-30_096af34eda9235dcd3c3938abe3a4a76_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_poet-rat_rusty-stealer_satacom_stealc_vidar
- Size 78.0MB
- Sample260701-hawsaags7p
- SHA256 b3da8a0d00fcd5130608f2a93d335832a19531991ad7e8d3d3eb74f59f821681
- MD5 096af34eda9235dcd3c3938abe3a4a76
- SHA1 0924fe443c462e41cbe54f30686007d4ab00f09b
- SHA512 625a3a06362f8ad17502a13de504cb49e398a2bfef6433b9dcd9f60a7053ac907c89240b1f5ce13dce616f67ec6220c714d41d1ee24865fea591a4e1dcbc43e4
- SSDEEP 786432:aD4BEBRrWflljmfOPodvjP5wLL7hA3iMtdiznn+xI/kMaz7YsED60+VimCgSl/6p:zodvjSLL7hKmn2Sl/6ArK
- TLSH T1C1088C47B3A510D5D4BBD238CA4B8617F7B27C51032197CB1168ABA92F73BE12A3E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-30_096af34eda9235dcd3c3938abe3a4a76_akira_cobalt-strike_coinminer_glassworm_hijackloader_ice.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_096af34eda9235dcd3c3938abe3a4a76_akira_cobalt-strike_coinminer_glassworm_hijackloader_ice.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_096af34eda9235dcd3c3938abe3a4a76_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_poet-rat_rusty-stealer_satacom_stealc_vidar
- Size 78.0MB
- SHA256 b3da8a0d00fcd5130608f2a93d335832a19531991ad7e8d3d3eb74f59f821681
- MD5 096af34eda9235dcd3c3938abe3a4a76
- SHA1 0924fe443c462e41cbe54f30686007d4ab00f09b
- SHA512 625a3a06362f8ad17502a13de504cb49e398a2bfef6433b9dcd9f60a7053ac907c89240b1f5ce13dce616f67ec6220c714d41d1ee24865fea591a4e1dcbc43e4
- SSDEEP 786432:aD4BEBRrWflljmfOPodvjP5wLL7hA3iMtdiznn+xI/kMaz7YsED60+VimCgSl/6p:zodvjSLL7hKmn2Sl/6ArK
- TLSH T1C1088C47B3A510D5D4BBD238CA4B8617F7B27C51032197CB1168ABA92F73BE12A3E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)