Extracted

• • Target
    2026-10-02_63d7798fd0f32c1010b4d471a344bb55_akira_conti
  • Size 355KB
  • SHA256 639a1a0d80c8f02e267db00be6c68101b0c79e9aa6562e35c96659c6cfeae487
  • MD5 63d7798fd0f32c1010b4d471a344bb55
  • SHA1 ab8834bc5e27d84a7593a9b6a166f2fac2aa7a7b
  • SHA512 9d25ef6de48cac3b07db58ebdf8435fed8d8f68e55d7eb68a637897cc3e2e541a8b02789911f933b91866a01b630142a0db314a888f955b17d12fd6e9f89a2cc
  • SSDEEP 6144:AwKuSy2+UMlQ7hgRSG58z540Y84tBEJrlemwl/KOiQg/G0EiApcZ6zsF3k:1jpeheSTQ8IEJrAQwcZ6wF0
  • TLSH
    T1B8747D53F6A6A4BCD16AC034931B9573BA33F88E06317DBF12E48A302E55D516F2CB19
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2