ade0657c0dfcbe13099492fa4d1c837ae5b1efc204fef9db5685f99dbe7e048e

General

Target
2026-07-27_359ea1cd5f8d54e43b1063303b6d20fa_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 9.7MB
Sample260727-mgqbaszglg
SHA256 ade0657c0dfcbe13099492fa4d1c837ae5b1efc204fef9db5685f99dbe7e048e
MD5 359ea1cd5f8d54e43b1063303b6d20fa
SHA1 19b46f3e00c9fb04241a78cebe1db06bed899bd3
SHA512 bcc51b53a403816d14e9cc2ee70aecc2feb610470eec2a973a1a27d4c28929264a963d01268afc41cf353e3f7b3cb7e3440421c8d3afc30a775d64e749c9f31e
SSDEEP 196608:cbzRuP0+VeHMH5mtCf6R4Y/lg64gnprO8+Ifj50:pc+VeHMH5mtCfi4Y/lZnNfhb
TLSH
T12AA6BE12AB9955E8C1BAC034D3574636AD7230DB0B34ABFB85C44A692F66FF46E3C344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-27_359ea1cd5f8d54e43b1063303b6d20fa_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
- Size 9.7MB
- SHA256 ade0657c0dfcbe13099492fa4d1c837ae5b1efc204fef9db5685f99dbe7e048e
- MD5 359ea1cd5f8d54e43b1063303b6d20fa
- SHA1 19b46f3e00c9fb04241a78cebe1db06bed899bd3
- SHA512 bcc51b53a403816d14e9cc2ee70aecc2feb610470eec2a973a1a27d4c28929264a963d01268afc41cf353e3f7b3cb7e3440421c8d3afc30a775d64e749c9f31e
- SSDEEP 196608:cbzRuP0+VeHMH5mtCf6R4Y/lg64gnprO8+Ifj50:pc+VeHMH5mtCfi4Y/lZnNfhb
- TLSH
  T12AA6BE12AB9955E8C1BAC034D3574636AD7230DB0B34ABFB85C44A692F66FF46E3C344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware spyware stealer upx
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2