2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat
Size 4.2MB
Sample260205-fdaccaft4a
SHA256 4d84747ecc98fc8af895f41443745fd80260d49b22cea30980e166b8501ab7cb
MD5 08b661718f9d5ab2b040afc88edd473d
SHA1 a8e2e79b7da51dcf38448c1e2bd3216a0827b273
SHA512 313fe287dfe30abc1d17d0e6a4f3cd63de84dc9f31cbaa88433495d515a1376b2b6b28b05cc8e99562ed05f7757868c63e38d2df38e19c7b86fabcd2c4b87850
SSDEEP 98304:+NHbjUJfSKmDk+4GxDKrQH3HG/wsB0EpJgkHDT21:BiDhdDfG/wsBJljT21
TLSH
T16B26E002F5F1F6ACC556C270531A9772A635BCCAA6307A7F0AE4B7302E75D604F18B68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat

File Explorer

2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat

.exe 4.2MB

2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat

IMPHASH 66692790c6de4312480e145740eada62
SHA256 4d84747ecc98fc8af895f41443745fd80260d49b22cea30980e166b8501ab7cb
MD5 08b661718f9d5ab2b040afc88edd473d
SHA1 a8e2e79b7da51dcf38448c1e2bd3216a0827b273
SHA512 313fe287dfe30abc1d17d0e6a4f3cd63de84dc9f31cbaa88433495d515a1376b2b6b28b05cc8e99562ed05f7757868c63e38d2df38e19c7b86fabcd2c4b87850
SSDEEP 98304:+NHbjUJfSKmDk+4GxDKrQH3HG/wsB0EpJgkHDT21:BiDhdDfG/wsBJljT21
TLSH
T16B26E002F5F1F6ACC556C270531A9772A635BCCAA6307A7F0AE4B7302E75D604F18B68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSidToSidW CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetVolumeInformationW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LocalAlloc LocalFree LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReadProcessMemory RegisterWaitForSingleObject RemoveDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

netapi32

NetApiBufferFree NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ntdll

NtCreateNamedPipeFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

pdh

PdhAddEnglishCounterA PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhCollectQueryDataEx PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetPerformanceInfo GetProcessMemoryInfo

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

shell32

CommandLineToArgvW ShellExecuteExW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

userenv

GetUserProfileDirectoryW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _exit _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset realloc signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat

advapi32

iphlpapi

kernel32

netapi32

ntdll

ole32

oleaut32

pdh

powrprof

psapi

secur32

shell32

ws2_32

userenv

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

msvcrt

generic