Extracted

• • Target
    2026-08-07_fe835441a6743f9c7e21b4c4f87405a2_akira_cobalt-strike
  • Size 1.4MB
  • SHA256 a79f7d5f737f4f1567205119b458fc0d32555566e750d0a7e96a986586da4a91
  • MD5 fe835441a6743f9c7e21b4c4f87405a2
  • SHA1 5c77de6375d07078428f4dc5c30f1fa179d7fc13
  • SHA512 1d87fc2d0a7d0c5d37e437b02ef1be723fbb490f858d8c32e2a9e9c1cd9a470a4f44d57d15b751e465466a36ae3884bcd54302925d3d9ddb61402d0e18835308
  • SSDEEP 24576:fMawm+QziCdL8hQFp8N5UGZhnWwO/dH+1:Hj+QGCdL8ip80GZhnWwO/i
  • TLSH
    T1A4657C63A595896DD302D13882E7933AB53932C52333AFB71DAD9E305F82DC64F29316
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2