09b6296875ae601f91f61d93cfc40a6f26d4128404a5c5a6e893fc2be4e3dfd3

General

Target
2026-07-12_68937a07b98a2a2d482f3d24259dda40_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz
Size 89.9MB
Sample260712-vg754sfx8w
SHA256 09b6296875ae601f91f61d93cfc40a6f26d4128404a5c5a6e893fc2be4e3dfd3
MD5 68937a07b98a2a2d482f3d24259dda40
SHA1 45f2490ac6644187334d5f6fef878bd0b82176c9
SHA512 938b525fa5e0eb93d7243e79c06dddcc9f186b90c42d948815f808953b420db4d8cd73c9f9daa465643d75b71c46a8f40587e09bbcbd9b8868200d6b24eece56
SSDEEP 393216:2AsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/l:2JUfzDIj20mvt5m6dG/ubi1F
TLSH
T17E2809B253A50A69E4BB5B78CDF1190E90F2BC222F39808FBA6727459F3F2D14671714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-12_68937a07b98a2a2d482f3d24259dda40_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz
- Size 89.9MB
- SHA256 09b6296875ae601f91f61d93cfc40a6f26d4128404a5c5a6e893fc2be4e3dfd3
- MD5 68937a07b98a2a2d482f3d24259dda40
- SHA1 45f2490ac6644187334d5f6fef878bd0b82176c9
- SHA512 938b525fa5e0eb93d7243e79c06dddcc9f186b90c42d948815f808953b420db4d8cd73c9f9daa465643d75b71c46a8f40587e09bbcbd9b8868200d6b24eece56
- SSDEEP 393216:2AsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/l:2JUfzDIj20mvt5m6dG/ubi1F
- TLSH
  T17E2809B253A50A69E4BB5B78CDF1190E90F2BC222F39808FBA6727459F3F2D14671714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2