Extracted

• • Target
    2026-08-25_8a658c331fe6a8153ede14b1e9361398_akira_cobalt-strike_quasar-rat
  • Size 980KB
  • SHA256 4dc2a8c90cb00278226ce75901f7d3531afa27a1c412ccd15b3bd40e74c96794
  • MD5 8a658c331fe6a8153ede14b1e9361398
  • SHA1 b334df86af12ba74ed8b6e5915675b2e3f3e9187
  • SHA512 40149db54939cd61a5cfc4f6c6527de4cf9f57f974305a0abea8c1ed9a2c1349785b6c872777542eb879cfc4a8708ae041b0473e74cfe3b9068b61b7b42d685e
  • SSDEEP 12288:lF2WJec1otiyzUy2DNl/DbSusi/jCo1+g16jYSSdnu8uxyKMTpJ:nRJVCEnDLoi/+o1916sSStu8aMD
  • TLSH
    T127259D4BB29192BDD15BC07483469A77F536B0CA0231BDBF06E497343E9AE654F2CB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2