2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat
Size 4.1MB
Sample260701-hern5aav3y
SHA256 3dd8194fe2ec6341578ab6a2cb5bf4b5e6587377e49b9b394c6cf65536445165
MD5 0370c5acd9cc3c20ed28c42b2c56071b
SHA1 28a7695bcc5633139209132684de045de127451f
SHA512 5c87c7f701d48d0999f6e6faa2342d739eea4ce248738871f266834441963b912683db118008b7f1568e6d6fad0d468c4fda060579e6bcaec8ea07d83dae760a
SSDEEP 49152:JmIikrCarOrtdP3BvIMGMZVbzqerYhDwANCbMXcrVTcdQ9DEoFCCkvSdnXVXoQ3w:gbqermDwAQKPYFXoeZvnd
TLSH
T1EC167C03FA9181E9C09EC175835B9732EA32F8894524B75B3798CB213F56F606F5E398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat

File Explorer

2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat

.exe 4.1MB

2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat

IMPHASH 69a7f2d2415a08a4f1b8c8d534a8b355
SHA256 3dd8194fe2ec6341578ab6a2cb5bf4b5e6587377e49b9b394c6cf65536445165
MD5 0370c5acd9cc3c20ed28c42b2c56071b
SHA1 28a7695bcc5633139209132684de045de127451f
SHA512 5c87c7f701d48d0999f6e6faa2342d739eea4ce248738871f266834441963b912683db118008b7f1568e6d6fad0d468c4fda060579e6bcaec8ea07d83dae760a
SSDEEP 49152:JmIikrCarOrtdP3BvIMGMZVbzqerYhDwANCbMXcrVTcdQ9DEoFCCkvSdnXVXoQ3w:gbqermDwAQKPYFXoeZvnd
TLSH
T1EC167C03FA9181E9C09EC175835B9732EA32F8894524B75B3798CB213F56F606F5E398
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageA FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetStdHandle InitializeCriticalSection K32GetPerformanceInfo LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory SetEnvironmentVariableW SetUnhandledExceptionFilter SystemTimeToFileTime TryEnterCriticalSection WideCharToMultiByte WriteConsoleW WriteProcessMemory CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError LoadLibraryExA AreFileApisANSI CancelIo CancelIoEx CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateRemoteThread CreateThread CreateWaitableTimerExW DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle FindClose FindFirstFileExW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FlushViewOfFile FreeLibrary GetComputerNameExW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetTickCount GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapCompact HeapCreate HeapDestroy HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetEndOfFile SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WriteFile WriteFileEx

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr log

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _exit _fpreset _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite

api-ms-win-crt-string-l1-1-0

memset strcmp strcspn strlen strncmp strspn wcslen

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _localtime64 _tzset

api-ms-win-crt-utility-l1-1-0

qsort

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlVirtualUnwind NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken SystemFunction036

oleaut32

GetErrorInfo SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_0370c5acd9cc3c20ed28c42b2c56071b_akira_glassworm_quasar-rat

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

pdh

powrprof

psapi

shell32

bcryptprimitives

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

bcrypt

crypt32

secur32

ws2_32

generic