Extracted

Extracted

• • Target
    2026-11-12_ce202cd2c7f2a99fdab2d29122d239bc_akira_cobalt-strike
  • Size 616KB
  • SHA256 bb886e67dd2b3c2224d9da2f3c52320d9da9da62095f6e8b568934a0ee6fb1ba
  • MD5 ce202cd2c7f2a99fdab2d29122d239bc
  • SHA1 179d4008e36b28605c599b724b1f42d58b69caca
  • SHA512 c356280d227d33d9ed258fc9cb00b4ea3508a16a13769b214e36d07cf2ba155ee3a05dd43633c787c48eef11ca40a3e76591f6cdf22ca56161aa30759ab9c3ba
  • SSDEEP 6144:i8+SUkroDhCRW5E1nnzYH3LJWg2uGpIpchBQQrtx+Si0GMup1rqOJW5HUAOJRA6F:in0osjnmd9k8qubkZDOljnftZWYtRyM/
  • TLSH
    T129D47D07B6E2D1BCD266C075934AA5B3FA3BB48706327DBB02E497303E59A546F2C714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionspywarestealeroverlordxmrigminerpersistenceprivilege_escalationrattrojan

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Custom signature

    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables containing URLs to raw contents of a Github gist

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Windows security bypass

    defense_evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1behavioral2