7b760abb32695b4531dc60731fae18f3db062ca237393300e2744b55e26711b2

General

Target
2026-06-25_1aa7713647fcbf984e006bafd5155330_akira_glassworm_quasar-rat
Size 4.2MB
Sample260629-3vnydsa18m
SHA256 7b760abb32695b4531dc60731fae18f3db062ca237393300e2744b55e26711b2
MD5 1aa7713647fcbf984e006bafd5155330
SHA1 c7f17ba4d7a720cf4ab9f02f53cbbff8e7facaec
SHA512 2111b54f7bfba3b5e94204311e26499c2ae85a07918fcdf59bf00740971fdfab71a7970f4391b8caa5e469ba61ba5d9766aa187874bcb6834d81de776ebabbf6
SSDEEP 49152:t89aCf4w3w225FEpRrdEZLJF0QPSdcPvFx13O7RIct0yncFIMGG3lLyTa741WIUk:DCf4Pf52prEZ80OOhgz+Fbw
TLSH
T126167C03E29580EDC06AC174876B9733FA32B8890534B66F17E4DB213E66F609F1E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_1aa7713647fcbf984e006bafd5155330_akira_glassworm_quasar-rat
- Size 4.2MB
- SHA256 7b760abb32695b4531dc60731fae18f3db062ca237393300e2744b55e26711b2
- MD5 1aa7713647fcbf984e006bafd5155330
- SHA1 c7f17ba4d7a720cf4ab9f02f53cbbff8e7facaec
- SHA512 2111b54f7bfba3b5e94204311e26499c2ae85a07918fcdf59bf00740971fdfab71a7970f4391b8caa5e469ba61ba5d9766aa187874bcb6834d81de776ebabbf6
- SSDEEP 49152:t89aCf4w3w225FEpRrdEZLJF0QPSdcPvFx13O7RIct0yncFIMGG3lLyTa741WIUk:DCf4Pf52prEZ80OOhgz+Fbw
- TLSH
  T126167C03E29580EDC06AC174876B9733FA32B8890534B66F17E4DB213E66F609F1E759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access discovery persistence privilege_escalation spyware stealer
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables referencing many IR and analysis tools
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2