Extracted

• • Target
    2026-08-16_26fae59afe8735ea324c69d31029b3d3_akira_cobalt-strike_quasar-rat
  • Size 795KB
  • SHA256 aeae449bf9ad3d9da55248af66cf04dbbf5f87d84f37d3b0c5ce16948ff5427f
  • MD5 26fae59afe8735ea324c69d31029b3d3
  • SHA1 53009518b3c94c0c7b720caf673f7b426dd6c51f
  • SHA512 5eeb6d2411851388ccf002b49230ca310df2741a55d99d4b8672a663423381bf51cc29f81f853864ea82d94cf90eb12385f350160a28198fd11e93be29d282a7
  • SSDEEP 12288:bTYGj8DnQ64URQZuzYGiYVvpfJekqoAqs2i/6gUfoiVrWZR:btj8z7QZuz7LvH2UfoErWf
  • TLSH
    T16C059E93B5D84A7DD206C13881DB633A7A3936C51333FBA709AC9A314F53AC25F5931A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2