Overview

overview

10

Static

static

10

2026-08-08...at.exe

windows10-2004-x64

9

2026-08-08...at.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat
  • Size 6.3MB
  • Sample260808-xcdrtack4v
  • SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryspywarestealer

Malware Config

Targets

    • Target
      2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat
    • Size 6.3MB
    • SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryspywarestealer

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

    • Detects executables using Telegram Chat Bot

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks