Extracted

• • Target
    2026-08-27_6244bdcc5a74926918a498209fc9773b_akira_cobalt-strike
  • Size 429KB
  • SHA256 68c56be3d4061cbe590e33c80139f5a8f6ae992b7a124ee9f5949824d8203ed7
  • MD5 6244bdcc5a74926918a498209fc9773b
  • SHA1 f75460a812e424430f6369ed1913f16a57228d25
  • SHA512 8a2114984f7196bd1c80db53127ffa27784b86d9dff67eb97f2a08321db0d8f1ff5b83fd8187fdc8df366f029d35eddd4d0f83fae1c0587658a05ee8115a8c76
  • SSDEEP 6144:QolUf7EtVzwgaIXDovYsWq5q4vJC/wMUiu2qqbJ09vjZQCWr4nBmAzZ:RcEtKrPWq5q4vWwMUxJbDdm
  • TLSH
    T1F8947C47B69595BCD15AC034834B9AB3FA73B48A0630BDBF03E4DA302E5AE615F1CB15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordxmrigminerpersistenceratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2