Extracted

• • Target
    2026-07-27_cd3e3d4a0a047ed9acf274afe8a3dc14_akira_glassworm_hijackloader_icedid_luca-stealer_njrat_rusty-stealer_stealc
  • Size 4.0MB
  • SHA256 cbacc01a247995ca1ac9fac9960b050365508119a8789c07a5d2d1118498cd1b
  • MD5 cd3e3d4a0a047ed9acf274afe8a3dc14
  • SHA1 4aa1e41cdf70f4c02e2360010876b49bc21ce4a0
  • SHA512 94e69c53dea061f6672668822befa1b841fa2041b7ab5c7dc7eed87304f9f9ba29b12fb486c5d1e6a8bf127ce244a446d1852f99e0d4e4d0a473ac45a52608ff
  • SSDEEP 98304:A/0YwxEzDFkQLUKQQ8wvbGDTfJ163ka8ayn+:uNldd8wMVb
  • TLSH
    T1F4169E03E69580E8C0AEC078C356B633EA72B88A1774B6DF57D44B112E26FD05B3E759
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxmrigminerpersistenceprivilege_escalationransomwaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Contacts a large (47076) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2