Extracted

• • Target
    2026-07-23_aede1d7f4cf3d0bd07e6a5c8b19e0e54_akira_cobalt-strike
  • Size 605KB
  • SHA256 61828172510b0ed9a14c827b0e412a0f27f72e8841fd29824cfae6b647d1bf52
  • MD5 aede1d7f4cf3d0bd07e6a5c8b19e0e54
  • SHA1 9d1db6100f9aacb298bdda90c29c7baba160a66b
  • SHA512 aa33ee6d7a59f32837c69adfa9201390b5b0dd3619f9c1706c15baee72eac6e9b92eaba7ee711051533a9f36717b22a44b80cfa97707726b84b718923bf82a19
  • SSDEEP 6144:FNLyl+e8+KdfUw+1K7tHiQ7AFf62QEubVLtzYfmIime+zi7fKN/JYATvig5zkXv5:n3+KdfUwuQ7ASfbVLZYfde7kz/YnL
  • TLSH
    T1EAD47C13B296D1BCC25EC034935A9636F632B8C61631BDBF07E48B312E29E555F2C729
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2