2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry
Size 5.3MB
Sample260211-cf2mtsey5c
SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
MD5 7c1c97f4a76c7e059b1c97a495eddb38
SHA1 1a78dd079852c331103205daf87fab6d0ea4725b
SHA512 e51a1b6f28e6a1b68dec868c2cb8a1cef34946c583254bcf9602af7008f95485fde193a20416ae3a6a221fd19296419a72813efebc081fbb7810831217c10692
SSDEEP 49152:9k4eR6D4daqOYHMnogsCvcGGAaXxSFmvnFkD1gLK2JQIOzM8zC+zX6Gij8h+l3SE:9kfHqoCvcGGnXxSDD+YuGCn
TLSH
T1CD46AE40FA53A1E8CE5B1570206FA73ACA344D0C4739CFE3EFE85D64BA5B3915829A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry

File Explorer

2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry

.exe 5.3MB

2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry

IMPHASH e11ff822ac3398649670df56a1c89efd
SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
MD5 7c1c97f4a76c7e059b1c97a495eddb38
SHA1 1a78dd079852c331103205daf87fab6d0ea4725b
SHA512 e51a1b6f28e6a1b68dec868c2cb8a1cef34946c583254bcf9602af7008f95485fde193a20416ae3a6a221fd19296419a72813efebc081fbb7810831217c10692
SSDEEP 49152:9k4eR6D4daqOYHMnogsCvcGGAaXxSFmvnFkD1gLK2JQIOzM8zC+zX6Gij8h+l3SE:9kfHqoCvcGGnXxSDD+YuGCn
TLSH
T1CD46AE40FA53A1E8CE5B1570206FA73ACA344D0C4739CFE3EFE85D64BA5B3915829A1D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileExW FindNextFileW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil exp log2 pow round trunc truncf

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1013KB

Virtual Size

1012KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry

kernel32

ntdll

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

userenv

ws2_32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic