88fe7c7547e2949cc70834f7425e2ca5c6187db6826c58aab23516b936cf6e2d

General

Target
2026-07-20_fc58549d99637278a27fbb2317534339_akira
Size 10.3MB
Sample260720-csveaae12v
SHA256 88fe7c7547e2949cc70834f7425e2ca5c6187db6826c58aab23516b936cf6e2d
MD5 fc58549d99637278a27fbb2317534339
SHA1 690bc2428abbdd4c8569a4530df83f05a8a07d1d
SHA512 9995009c86f27da8257b7a93545ad13a8b859674ef61d6b0caa6ac5c3b26ac56b2d83c353e2dbb5c7118d19c5979a95c4686042e8e29de785696e8dc9d7c2e77
SSDEEP 24576:zVVjxPn9CAfyDA1ZsjTykBbKhmbCuvAjcbr5mvQAm+91U+o/LE495mbo0ojWc1RA:h1HECik/F7zPZDJ3OE5Ge
TLSH
T14EB6AFB875443CE2F66F477BD99AACDC03B61763AA8795C9406577C30DA33E5EE02808
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-20_fc58549d99637278a27fbb2317534339_akira
- Size 10.3MB
- SHA256 88fe7c7547e2949cc70834f7425e2ca5c6187db6826c58aab23516b936cf6e2d
- MD5 fc58549d99637278a27fbb2317534339
- SHA1 690bc2428abbdd4c8569a4530df83f05a8a07d1d
- SHA512 9995009c86f27da8257b7a93545ad13a8b859674ef61d6b0caa6ac5c3b26ac56b2d83c353e2dbb5c7118d19c5979a95c4686042e8e29de785696e8dc9d7c2e77
- SSDEEP 24576:zVVjxPn9CAfyDA1ZsjTykBbKhmbCuvAjcbr5mvQAm+91U+o/LE495mbo0ojWc1RA:h1HECik/F7zPZDJ3OE5Ge
- TLSH
  T14EB6AFB875443CE2F66F477BD99AACDC03B61763AA8795C9406577C30DA33E5EE02808
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing common artifacts observed in infostealers
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing combination of virtualization drivers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet
- Detects executables using Telegram Chat Bot
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VirtualBox executables on disk
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2