General
- Target 2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike
- Size 299KB
- Sample260729-dd779sshpc
- SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
Score
10/10
Malware Config
Targets
-
- Target 2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike
- Size 299KB
- SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
Score9/10-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Modifies Windows Firewall
-
Disables service(s)
-
Stops running service(s)
-
Modifies boot configuration data using bcdedit
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Pre-OS Boot
1Bootkit
1