864a386241ae55c2259f4a5f72c77e60eeb5546fcca9d98a62af7640803cc18c

General

Target
2026-08-07_7ba83b37eafa1391821a3ea125fe6c77_akira_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar
Size 40.9MB
Sample260807-gnlzkaec35
SHA256 864a386241ae55c2259f4a5f72c77e60eeb5546fcca9d98a62af7640803cc18c
MD5 7ba83b37eafa1391821a3ea125fe6c77
SHA1 54b1ef4cd0813e82d8bc4740982e1bd6e1bfd4a6
SHA512 c96e39d5d1f94c800373cd7b8f6540c4706eeeb26bcb87bff19a9b2ce1a793e6666e1bd35a5a5aabcb43dc4b6231863571ed90e74f0bd9ad546bb8624309e4b9
SSDEEP 98304:Nuj9nmneNvl8/HgAKaF3CMGQ23dVcL8kxEPja:8Rnmedl8vgAKa1RGQ23dtkSPja
TLSH
T12E97F58FBB42CDC1DA4691F0549BB76023FEFC655BE1C32312D46B21AE9718C8DA35A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_7ba83b37eafa1391821a3ea125fe6c77_akira_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar
- Size 40.9MB
- SHA256 864a386241ae55c2259f4a5f72c77e60eeb5546fcca9d98a62af7640803cc18c
- MD5 7ba83b37eafa1391821a3ea125fe6c77
- SHA1 54b1ef4cd0813e82d8bc4740982e1bd6e1bfd4a6
- SHA512 c96e39d5d1f94c800373cd7b8f6540c4706eeeb26bcb87bff19a9b2ce1a793e6666e1bd35a5a5aabcb43dc4b6231863571ed90e74f0bd9ad546bb8624309e4b9
- SSDEEP 98304:Nuj9nmneNvl8/HgAKaF3CMGQ23dVcL8kxEPja:8Rnmedl8vgAKa1RGQ23dtkSPja
- TLSH
  T12E97F58FBB42CDC1DA4691F0549BB76023FEFC655BE1C32312D46B21AE9718C8DA35A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2