5334b3e023b4e3abe6d401a31173d6c887a05572ad1aba942ed74d1fa04d5153

General

Target
2026-08-15_44452f024fdaeef8a1f54156c152e782_akira_cobalt-strike_coinminer_glassworm_hijackloader_rusty-stealer_satacom_vidar
Size 61.7MB
Sample260815-by969axsft
SHA256 5334b3e023b4e3abe6d401a31173d6c887a05572ad1aba942ed74d1fa04d5153
MD5 44452f024fdaeef8a1f54156c152e782
SHA1 931a83c6c0f9d6f272c2c66613c997309596ee4d
SHA512 65c9b50c7daea68760a82087b3b33c46b9f21c51cde568ba29be69b5c87da98a4aaa001b112094738644e15dc3165f76a6fa0c6ba952ee2d9d432532fce34350
SSDEEP 786432:N7EaHSD1t2fEL1PaA6AqYYcvaEJefBPzXyK6ArKz:NoB2fEMEJwZ96ArKz
TLSH
T153E78D0273644056E5A6C0B48D279623EBB27C5A172173EB25E4FAAC2F73FD15ABC344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_44452f024fdaeef8a1f54156c152e782_akira_cobalt-strike_coinminer_glassworm_hijackloader_rusty-stealer_satacom_vidar
- Size 61.7MB
- SHA256 5334b3e023b4e3abe6d401a31173d6c887a05572ad1aba942ed74d1fa04d5153
- MD5 44452f024fdaeef8a1f54156c152e782
- SHA1 931a83c6c0f9d6f272c2c66613c997309596ee4d
- SHA512 65c9b50c7daea68760a82087b3b33c46b9f21c51cde568ba29be69b5c87da98a4aaa001b112094738644e15dc3165f76a6fa0c6ba952ee2d9d432532fce34350
- SSDEEP 786432:N7EaHSD1t2fEL1PaA6AqYYcvaEJefBPzXyK6ArKz:NoB2fEMEJwZ96ArKz
- TLSH
  T153E78D0273644056E5A6C0B48D279623EBB27C5A172173EB25E4FAAC2F73FD15ABC344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution spyware stealer
- Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2