a6b09ac50c9d3e38a8049f18c3ebaf0598b47035e283e4bbc3b6f130d24fae4a

General

Target
2026-08-15_8e43d40df4235171c65c1f28c28bafe5_akira_cobalt-strike_coinminer_glassworm_hijackloader_rusty-stealer_satacom_vidar
Size 62.1MB
Sample260815-bqny2swend
SHA256 a6b09ac50c9d3e38a8049f18c3ebaf0598b47035e283e4bbc3b6f130d24fae4a
MD5 8e43d40df4235171c65c1f28c28bafe5
SHA1 c722b725166fd23e359dd91bfa178ab455426c2d
SHA512 6ecbd9577199e97ceea25a7ac04b4469ab3eaf7206c45846400c0ce33370949f87c50f02a8fc2764b4e2af73325098c9c371befee750debc15232f4cfec69ba2
SSDEEP 786432:JhtXXD1M2fEw1PaA6AqYYcvaEJefBPzXyK6ArKv:/tXG2fE5EJwZ96ArKv
TLSH
T17EE78D0273644056E5A6C0B48D679623EBB27C5A172173EB24E4FAAC2F73FD15ABC344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_8e43d40df4235171c65c1f28c28bafe5_akira_cobalt-strike_coinminer_glassworm_hijackloader_rusty-stealer_satacom_vidar
- Size 62.1MB
- SHA256 a6b09ac50c9d3e38a8049f18c3ebaf0598b47035e283e4bbc3b6f130d24fae4a
- MD5 8e43d40df4235171c65c1f28c28bafe5
- SHA1 c722b725166fd23e359dd91bfa178ab455426c2d
- SHA512 6ecbd9577199e97ceea25a7ac04b4469ab3eaf7206c45846400c0ce33370949f87c50f02a8fc2764b4e2af73325098c9c371befee750debc15232f4cfec69ba2
- SSDEEP 786432:JhtXXD1M2fEw1PaA6AqYYcvaEJefBPzXyK6ArKv:/tXG2fE5EJwZ96ArKv
- TLSH
  T17EE78D0273644056E5A6C0B48D679623EBB27C5A172173EB24E4FAAC2F73FD15ABC344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2