General
- Target 2026-07-15_2b3d427cb8cb7a6f805789195ea59399_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_pos_satacom_vidar_zxxz
- Size 54.6MB
- Sample260715-fwsxeact4n
- SHA256 462e5aa500fd6b340b8fb22408b5678b2a02dbde20fe64b07c7dd489aa1c9ce3
- MD5 2b3d427cb8cb7a6f805789195ea59399
- SHA1 87968b04b40745e7cbbcf5b8d9e5686c463a047b
- SHA512 c827fb29b2b66806c3b6e4a7cb0affbafcc4da4082430b4016aa00166a65826ea5d666fa4db6bfdc259864c654afc701493f936df8d77b8565088cee8672ee05
- SSDEEP 786432:N7j265sMD1e2vAcqwnQ3elMU2EqefBzJn1+4Bu:Zj2ssR2OEqwz84Bu
- TLSH T10BC77D0233684055E8A2C67C9D134257EB71BC563B2367EB20A9E15D2F73BE15BBE348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-15_2b3d427cb8cb7a6f805789195ea59399_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_2b3d427cb8cb7a6f805789195ea59399_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_2b3d427cb8cb7a6f805789195ea59399_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_pos_satacom_vidar_zxxz
- Size 54.6MB
- SHA256 462e5aa500fd6b340b8fb22408b5678b2a02dbde20fe64b07c7dd489aa1c9ce3
- MD5 2b3d427cb8cb7a6f805789195ea59399
- SHA1 87968b04b40745e7cbbcf5b8d9e5686c463a047b
- SHA512 c827fb29b2b66806c3b6e4a7cb0affbafcc4da4082430b4016aa00166a65826ea5d666fa4db6bfdc259864c654afc701493f936df8d77b8565088cee8672ee05
- SSDEEP 786432:N7j265sMD1e2vAcqwnQ3elMU2EqefBzJn1+4Bu:Zj2ssR2OEqwz84Bu
- TLSH T10BC77D0233684055E8A2C67C9D134257EB71BC563B2367EB20A9E15D2F73BE15BBE348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects Windows executables referencing non-Windows User-Agents
- Custom signature
Detects executables containing URLs to raw contents of a Github gist
Loads dropped DLL
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.