General

  • Target
    2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 9.3MB
  • Sample260802-dabpwssfrb
  • SHA256 e7f5d0f9bd18b268c8832b5222fa05cb3650e6deeeaf7d3a92a3a619a8c11d8a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=EventBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=NewsBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=ForceGetBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=BroadcastGetBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=TrialBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=TrialBooster

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://privateredeyeapi.com/?action=BroadcastGetBooster

Targets

    • Target
      2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom
    • Size 9.3MB
    • SHA256 e7f5d0f9bd18b268c8832b5222fa05cb3650e6deeeaf7d3a92a3a619a8c11d8a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to get system information as a root user.

    • Network Share Discovery

      Attempt to gather information on host network.

MITRE ATT&CK Enterprise v16

Tasks