e4dfbc899c89127a26512a074e8cc4e51150cd1f07e1033424ce6e578c08e7fa

General

Target
2026-08-01_e113b1b45c83d0b664c0b5c20975b329_akira_cloudeye_cobalt-strike_icedid_rusty-stealer_satacom
Size 67.5MB
Sample260801-bdf3nscj3v
SHA256 e4dfbc899c89127a26512a074e8cc4e51150cd1f07e1033424ce6e578c08e7fa
MD5 e113b1b45c83d0b664c0b5c20975b329
SHA1 a57b6daa943375b4b518f28d6a0dc04322129010
SHA512 a809c63063651e1e29af6a3c6e9d0b1ec852403b84714fc72d1fc4c53f0759ce53e8826e224aee6c391c0c0deef9c01227c29b7274d428878b01d07cdd77904a
SSDEEP 1572864:XejOYf5VsnukHp41P5DCXZ+M9/2sO1DrPk:X40nuwp41P5iZ+M9/u1vM
TLSH
T1BDF733A0BAF974BCDC91A475E32DF52B8B37AC450963627F25AC50627734E81CF2850B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-01_e113b1b45c83d0b664c0b5c20975b329_akira_cloudeye_cobalt-strike_icedid_rusty-stealer_satacom
- Size 67.5MB
- SHA256 e4dfbc899c89127a26512a074e8cc4e51150cd1f07e1033424ce6e578c08e7fa
- MD5 e113b1b45c83d0b664c0b5c20975b329
- SHA1 a57b6daa943375b4b518f28d6a0dc04322129010
- SHA512 a809c63063651e1e29af6a3c6e9d0b1ec852403b84714fc72d1fc4c53f0759ce53e8826e224aee6c391c0c0deef9c01227c29b7274d428878b01d07cdd77904a
- SSDEEP 1572864:XejOYf5VsnukHp41P5DCXZ+M9/2sO1DrPk:X40nuwp41P5iZ+M9/u1vM
- TLSH
  T1BDF733A0BAF974BCDC91A475E32DF52B8B37AC450963627F25AC50627734E81CF2850B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution defense_evasion
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2