General
- Target 2026-07-29_64ef855cfbaaf761a815f230ac7634c9_akira_bazarloader_coinminer_glassworm_poet-rat_quasar-rat_remcos
- Size 100.1MB
- Sample260729-c8qe9svvbv
- SHA256 3fba3b5c524834a98599e9dd77512530fbce44be6c3d60e08ee0b0fc63bdfdb2
- MD5 64ef855cfbaaf761a815f230ac7634c9
- SHA1 8b414c084e1edc5281a0fca9d9f057b219cc31f9
- SHA512 c590fdc279ad489d087547e80d1a7996427ffab96e3babc4e65405f016924afa0940154d2f49d59de7a9803d995654710c2ac4a26eefbf0f505ac15441776204
- SSDEEP 1572864:pUPBQoHVtKJcC1l+puFCwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhP0E:03ux
- TLSH T194388D9EE1E3509CC22BD4B0437EFB73BA24746C11246E7A62D9DA306E62FC0571AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-29_64ef855cfbaaf761a815f230ac7634c9_akira_bazarloader_coinminer_glassworm_poet-rat_quasar-rat_remcos.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-29_64ef855cfbaaf761a815f230ac7634c9_akira_bazarloader_coinminer_glassworm_poet-rat_quasar-rat_remcos.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-29_64ef855cfbaaf761a815f230ac7634c9_akira_bazarloader_coinminer_glassworm_poet-rat_quasar-rat_remcos
- Size 100.1MB
- SHA256 3fba3b5c524834a98599e9dd77512530fbce44be6c3d60e08ee0b0fc63bdfdb2
- MD5 64ef855cfbaaf761a815f230ac7634c9
- SHA1 8b414c084e1edc5281a0fca9d9f057b219cc31f9
- SHA512 c590fdc279ad489d087547e80d1a7996427ffab96e3babc4e65405f016924afa0940154d2f49d59de7a9803d995654710c2ac4a26eefbf0f505ac15441776204
- SSDEEP 1572864:pUPBQoHVtKJcC1l+puFCwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhP0E:03ux
- TLSH T194388D9EE1E3509CC22BD4B0437EFB73BA24746C11246E7A62D9DA306E62FC0571AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Modifies WinLogon
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Image File Execution Options Injection
1