Extracted

• • Target
    2026-08-21_55155dd9d87581b915eb4379c99610b0_akira_cloudeye_glassworm_rusty-stealer
  • Size 117.2MB
  • SHA256 26964bd8eb94674eb4cb60c71447ba8fdfb2295ccde8c5cc05b42acd7d347946
  • MD5 55155dd9d87581b915eb4379c99610b0
  • SHA1 0a481cb4e5d37b1f84bbad33c3cdeca91e95584c
  • SHA512 d14da93132f7e73003b420995f2cb0eda9e21e39e9334d07ee9dfe899c782015c90b6a22f7ef7b5f23047457424e4cab512fd69a420c8817ee1644ea3d482210
  • SSDEEP 3145728:gyohh18K75dF/boRdDb6hkjb8wyBIJVWdllyCeWIfxDK:uKK7FWx60bWBtdll7eTfxDK
  • TLSH
    T1214833227B4A99AEC55AC078824687B25A3234CB0F35B5FF418496783F79EF51B3C394
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutioncobaltstrikepersistencespywaretrojan

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2