General
- Target 2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 650KB
- Sample260929-se64xsty3k
- SHA256 545cc3348e4b3e3eaa89344ab39b27284fbae6690d3b2cd1f599de2e43a3c84a
Score
9/10
Malware Config
Targets
-
- Target 2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom
- Size 650KB
- SHA256 545cc3348e4b3e3eaa89344ab39b27284fbae6690d3b2cd1f599de2e43a3c84a
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables packed with ConfuserEx Mod
-
Detects executables referencing many IR and analysis tools
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger