Extracted

• • Target
    2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat
  • Size 5.7MB
  • SHA256 10f75b9ee94260c94591ff77f665fee033e2ee1dfc1680453aeacbb89c3ac474
  • MD5 6c4c2f375a16eb4bc60867d0959d7910
  • SHA1 04880630858600586f43e00188098b3293341842
  • SHA512 0855323c829f6964c69b3fcbff58991709ecdc79dd608ab9b13784dc43cd98bfa66eedac23c834ca3288dfa0b62720370bfad493aab463a4fc8bf8a290cebf63
  • SSDEEP 98304:vdkOt+u6Zlnk4dA9R6nzcYae3FbxtgboHN/K0Tc0+/m:rxN/IgYagLtEiK2R
  • TLSH
    T1EB564A47F2A390ECC16AC174831AA233FA32BC5945357AAB57D4DB343E62F506B2DB14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorwindowsdefense_evasiondiscoveryexecutionmeshagentpersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Windows security bypass

    defense_evasiontrojan

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Modifies RDP port number used by Windows

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2