General
- Target 2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira
- Size 75.5MB
- Sample260804-qctppsfl31
- SHA256 d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c
Score
10/10
Malware Config
Targets
-
- Target 2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira
- Size 75.5MB
- SHA256 d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Looks for VirtualBox drivers on disk
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Looks for VMWare drivers on disk
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1