Extracted

• • Target
    2026-08-07_21d7127cee11a77ec2ce239801caa372_akira_cobalt-strike
  • Size 812KB
  • SHA256 c9dfc311cd13c7b6eec9e0085cb06b1c135c233bfcfce3079d611e5dcab20980
  • MD5 21d7127cee11a77ec2ce239801caa372
  • SHA1 0f02e886c1c242cdcaba8dca576c0da3eb3d1b61
  • SHA512 6d23d3d898fef920463e1d5de33a3ad3231eccbd59f9acb380197cf3e9a689055b344f824a12892c4c5941118baa0212d8d6d8b0fd93b2c2b1e3cc5bdb2e49f5
  • SSDEEP 12288:cbBSGm0IiDQnqmY9cV13x/R/jW5qs2OGnrCy:cbBCA4qmY9czWanrCy
  • TLSH
    T188058C9375A598BCD212C13C81976237BA3A76851333BFB309B8DE311F56AC26F58316
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2