Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 10.5MB
  • SHA256 9c6827030e1af86c304a8ce08b8fd803ff3a33775f29eec77f7633b5e99f8112
  • MD5 dce77eeca7959c65260ddd705f505ceb
  • SHA1 9755cae0035658fb0952c28a75b53cef6bb017a2
  • SHA512 a3390a4cb198df98330fc0fbe3c3c2e52b540d809e9ebe845a6e727de057459facadeb921b8494dc1d1ebeafa7bcfa7260312df04d7fffccbe4b06347d7d57be
  • SSDEEP 98304:T0amP3op3n+S8/pfUXR96QhGighKUZvYhGk7u0eYoKb+f28ujaBclGfGRnADrgRF:sPw3n+S8mhGigY7JXZ028ujfRMX0/
  • TLSH
    T12DB64D03F66280E8C06AC5B5835AE633FB32B88D493472BF5BA45B312E65F506F1D758
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistenceransomwaretrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  behavioral1behavioral2