Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 10.5MB
  • SHA256 eec29a29473707d2e7ee84c8cdd53e6501a83b95521a6f9f1d2828e5e70563e8
  • MD5 c58bd4daacc83720f956858e027518fd
  • SHA1 e7f402915666073c605de7b19f10187f044451e7
  • SHA512 edf2a0e2b10bc1efdbc8c8a6812dfaa8543a61efa0ddd38f7d99622c2281a3025a9fac2162d8ec36e2d4f9eb78a470e71175f5edc040671ce57318cab142d053
  • SSDEEP 98304:h+Ll9PDx5zx21C3/FRSpNsQWOvVIMIuCQOe/EpyMM3GtEXENPAMxm+1Gh5hQCDRC:29PvxgCIWOvjIppZM2W4AMhMXeWE
  • TLSH
    T13CB64C03F66290E8C06AC575835AE633FB32B88D493472BF6BA45B312E65F506F1D748
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistenceransomwaretrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information as a root user.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  behavioral1behavioral2