72f8b5ce6e30573738dda61dd2a98beb7513f1793b064a95cc0d423aeb9272b5

General

Target
2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 4.1MB
Sample260803-c9186a1thy
SHA256 72f8b5ce6e30573738dda61dd2a98beb7513f1793b064a95cc0d423aeb9272b5
MD5 3cf8dceb488f55f777d18fa64adae70b
SHA1 4abda7db9f5a68b8cdaed14740f40291a2e1f52f
SHA512 03a908aa7fc49ff7effed7b848f6d9d6c8c84ba67dbaa9173a08e22446b4f828b29dfd88d5827ceeaaada910d507080e94a2b94d66a53296002cf93ebd6905eb
SSDEEP 49152:z6F0eMpAAYEhpdhwt6HlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw6:i0nAAYEpdhU629jht3zpfuOHUn
TLSH
T161167B56F28680F8D42AD0B0860AE672E5307C494731A9EB57D4FF253E73BE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3cf8dceb488f55f777d18fa64adae70b_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4464
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6376.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6376.tmp
Size 1.2MB
SHA256 29fba57f65fa30ec5fd7935910dec2167ef3d930a925a461ca0a2b793e8da8f4
MD5 1a8cab8de4d8f809912807b9d777666f
SHA1 3817472670a1c91cf09911a38d7aaed010564aae
SHA512 4049e536314a0f6a4ed5545f361d3b2064ff585ad281fc36e2fa53d0ec3212e430eecf3fb4ab5944ee1bf378801ebdddca3adf7ef49c03b879c8439fbd3805b8
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQIYA+w7q:36F0eMpAAYEhpthwm
TLSH
T1ED456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 2.9MB
SHA256 3d60f4ac797bbaba526aec448e3b6399843a94cb1fb95ce256c8d14ad770a84d
MD5 b6ab38ce565b04bfbb9064be9f3b3872
SHA1 a52e2882b21927bea4238a4ee43805506c3df9c5
SHA512 cf2ad3e8467226f0e27c35990d093bc19bf3cdd7b7f634ba9ae61daf66aa4d101a34af97c4dfe3e7e48a1d6612f09e4436429fa056efd719909ae4592f4b8ccf
SSDEEP 49152:uHlsEAxOu8B0ThJfVGgTGgpVWBSfejK8BqSGuOmIF7Uw:u29jht3zpfuOHU
TLSH
T1B3E56B13F29A50E8D05AD0B8C74A9631F9717C850B2069EF0394FB252E77BE46F3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 9b7f39b6c93e933f4f8a528947b7c8fd3698ca7aa7328e1c8810883a8a16ead1
MD5 15f605fa2be01939eb9ca96986ca20ac
SHA1 5c509bc59ad4dba7fa3e24b761d3aa84230532a5
SHA512 1c2c13a05393da6bcc7cde2656ce686438bab0f0d8f50bc9e53623a84ff6593f6a1b01138424a4488f84af960cd55e165721b7ca0d620628dbe4dad35fbfaaca
SSDEEP 24576:47VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+IYA+wLg:T6F0eMpAAYEhp7hw8
TLSH
T10E456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 e3e30f792ba17cf491f3f9871dc3f6c996625d14fd6fbc1e76d931b6a4afe939
MD5 da3a60b8cd06b03ca0f10581deb76e75
SHA1 a9b636c5d84383b4de5ce4bb8bd7825b11eaecd8
SHA512 26f0b0b62616b273d2454995a20169df9ac449c169667e3a9d6cdd70b64ed46f687262b3a065da1d863f799b3c8455a92c063d2db3aa6c14953b930c688649f7
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8IYA+wem:z6F0eMpAAYEhpdhwt
TLSH
T1B4456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 530a926779eb4f56c2c01c612c842f445889238e307b144b5fb41e139ae68265
MD5 e21dfe5b587745d151bd70e5b8760820
SHA1 2beb713e91f8e80120d77c55e4f22413b3448695
SHA512 86f4e2dfb108d18e2d6d2edf0d44ee80639584e51750967d86d335b58e6d9046e5333f0d3c3ebbd3369e1503d5b28303b990ff626d296db2064a1ca81b0fc473
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6IYA+wyb:z6F0eMpAAYEhpbhwY
TLSH
T1FB456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ca4c42f20db41bc8d6c7b0477fa4c6da808fef48af6aec1af4cb65f8a2acf58f
MD5 fa507e9aaa3daa1f595f1353d883aa0d
SHA1 0d9e7445494f683dd44a24c716a29f1e04c6ee16
SHA512 ffcd1890eea6c7a1afea0c7f5fbd6b6b6e77d0a320c11c67f2304a8c1c33c29a9cad7238d62d7870d91c650a61a93b821add9462424b8890d7f6c1fd57d22eb2
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3IYA+w7C:H6F0eMpAAYEhpKhw+
TLSH
T14D456C94E787C4F5ED2314F0444BE7FBA5309E2980318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-153-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads