Extracted

• • Target
    2026-08-09_8f5d11bb74d6d3700488882236274755_akira_cobalt-strike_quasar-rat
  • Size 1.4MB
  • SHA256 7e3d6f7e45356982679d18ba0005c495f25ec22b08102ba1eb4dce870b1a9f31
  • MD5 8f5d11bb74d6d3700488882236274755
  • SHA1 8e9d7aae7cf796a686e73f9fed5d0329e08a3861
  • SHA512 5102e9fda2fcd284ae1237ff46b54cab9a632733a4e25358b41320506ec9fa3b2b7ebece09ff7fc15b79aabb6b18fc91e954aa4ce5c2eba717c39288ae47013c
  • SSDEEP 24576:GLV4sfsWPXYi+dFjl996rUSb8CZ8aKGNhnsm68o4:GLV3sYXYFdFjl996rb8CiGNhnsm68l
  • TLSH
    T1EE657B53A5955AAED702D13882E7523A753932C52332EFB31D9CDE306F82EC54F2931A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2