2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat
Size 1.1MB
Sample260503-dynpcsaz9s
SHA256 6186295629f69e312f4ce67227b0b673c466e54174c31a4c71406cf37530621f
MD5 884a846b0a556eeee389f864a6c8b273
SHA1 666748786ba0469e71567fcb375f7a3d26a640ae
SHA512 0c27f96e228130d8e6317be37a1620e26e9cd468cbf6d0c6edff3ccc8027d5ba5ec7e336ef145026d5fb2bdd5248bdf595b498f47c8920f6d1d150f5f3fa0bad
SSDEEP 12288:9Z3dqXTL0bY629Q1F/BPUobjK8BPCVFVC4pxiyQsnWLUHRSjpIErVuukCHvc4:9Zjbp29Q1xBPhPCI4pxiIWISdBVuunk
TLSH
T136454803A69885EAC85EC07887579632BA33B89D0730B6EB27D45B343E57F506F0E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat

File Explorer

2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat

.exe 1.1MB

2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat

IMPHASH 8511f845c9f9d909af17ed3919310bd7
SHA256 6186295629f69e312f4ce67227b0b673c466e54174c31a4c71406cf37530621f
MD5 884a846b0a556eeee389f864a6c8b273
SHA1 666748786ba0469e71567fcb375f7a3d26a640ae
SHA512 0c27f96e228130d8e6317be37a1620e26e9cd468cbf6d0c6edff3ccc8027d5ba5ec7e336ef145026d5fb2bdd5248bdf595b498f47c8920f6d1d150f5f3fa0bad
SSDEEP 12288:9Z3dqXTL0bY629Q1F/BPUobjK8BPCVFVC4pxiyQsnWLUHRSjpIErVuukCHvc4:9Zjbp29Q1xBPhPCI4pxiIWISdBVuunk
TLSH
T136454803A69885EAC85EC07887579632BA33B89D0730B6EB27D45B343E57F506F0E719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

AddVectoredExceptionHandler CreateToolhelp32Snapshot FormatMessageW FreeConsole GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentDirectoryW GetEnvironmentVariableW GetStdHandle Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter WriteConsoleW CloseHandle CreateFileMappingA CreateFileW CreateIoCompletionPort CreateThread CreateWaitableTimerExW DuplicateHandle FindClose FindFirstFileExW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete MapViewOfFile PostQueuedCompletionStatus SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc WaitForSingleObject DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

user32

MessageBoxW ShowWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fflush fprintf free malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf

Name

.text

Size

757KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-03_884a846b0a556eeee389f864a6c8b273_akira_glassworm_quasar-rat

advapi32

kernel32

user32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

crypt32

ntdll

secur32

ws2_32

msvcrt

generic