General
- Target 2026-07-02_9e27b5c129b4a76306b4acdeae9bce8d_akira_cobalt-strike
- Size 430KB
- Sample260702-vg8fwafv2j
- SHA256 06c8e30d97d78d150260e3fb0d5653fb2aeed5e83f95d7302ff7b20e019a1aaa
Score
10/10
Malware Config
Targets
-
- Target 2026-07-02_9e27b5c129b4a76306b4acdeae9bce8d_akira_cobalt-strike
- Size 430KB
- SHA256 06c8e30d97d78d150260e3fb0d5653fb2aeed5e83f95d7302ff7b20e019a1aaa
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of SetThreadContext