Extracted

Extracted

• • Target
    2026-11-09_55ad184e9ac5627ceb0f9b792fa386a1_akira_cobalt-strike_icedid_rusty-stealer
  • Size 523KB
  • SHA256 48a2a98eda3b081c1872de8b6cc6e38bf8466857fa187433ab5811e5407ad944
  • MD5 55ad184e9ac5627ceb0f9b792fa386a1
  • SHA1 33fb252920322c082e998ad497fa85d25ae96b07
  • SHA512 f22d06433144669c3fa208bf3ef64e63b17e273a5bb8fcb28500627d7e06338df065af272ee6feb9a052f3a45cfc7918cab94d3c46f2696ee8925a1a30b8d733
  • SSDEEP 6144:aspoR4XLWWhBhloJbldB/1vHiFhEg6ZFuBtPNmDW0aNK/aO8+Edm:as6F+s/uBrwb6d
  • TLSH
    T159B47081BE0C58B6FDD1A0304143AD1D6D697FC7BB2C75DF318EB1242937EA49AA5E04
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecution
  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2