General
- Target 2026-08-27_7f20cf174f7e7e6003ebb8eb3363abb0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
- Size 2.3MB
- Sample260827-rekp9avtex
- SHA256 c75e4edfde7f1e943dc5c949654847aeb494e636eaa454fb77e7436e0a9e72c5
Score
8/10
Malware Config
Targets
-
- Target 2026-08-27_7f20cf174f7e7e6003ebb8eb3363abb0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
- Size 2.3MB
- SHA256 c75e4edfde7f1e943dc5c949654847aeb494e636eaa454fb77e7436e0a9e72c5
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1