2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat
Size 4.3MB
Sample260711-dpc69sds7t
SHA256 329da2d64ac21d00a53479b3802fca17eec32f9c00d8f8dafbc5f1a300968e52
MD5 2483d141f75e850fe571dca288ef2ba1
SHA1 08eb46b967bd0f22e92cc73e1bfc0b81fc6176a5
SHA512 fb67fd9b58ec28f026ed1214fc188ea1fef0bff56c1ee6342f95c7f0b03cafce76357edfbeb512e03546088c6c4734dc3663bbca2377a2ba3327767e7fe13520
SSDEEP 49152:1A5riSUaGDz0kb54zfhYsEJh2j3z0ftoSgI1rWywkK4pxqCl1e/pGtP9OY/CIP+U:drqLu2j3hA1rlY4pxZjt1dJ+s
TLSH
T1E8266C43F69181E9C09EC178835BA733BA32FC9D4521B79B1BD48B213E22B606F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat

File Explorer

2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat

.exe 4.3MB

2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat

IMPHASH 0e5097928b8ee222811606cd796b3d0d
SHA256 329da2d64ac21d00a53479b3802fca17eec32f9c00d8f8dafbc5f1a300968e52
MD5 2483d141f75e850fe571dca288ef2ba1
SHA1 08eb46b967bd0f22e92cc73e1bfc0b81fc6176a5
SHA512 fb67fd9b58ec28f026ed1214fc188ea1fef0bff56c1ee6342f95c7f0b03cafce76357edfbeb512e03546088c6c4734dc3663bbca2377a2ba3327767e7fe13520
SSDEEP 49152:1A5riSUaGDz0kb54zfhYsEJh2j3z0ftoSgI1rWywkK4pxqCl1e/pGtP9OY/CIP+U:drqLu2j3hA1rlY4pxZjt1dJ+s
TLSH
T1E8266C43F69181E9C09EC178835BA733BA32FC9D4521B79B1BD48B213E22B606F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot FormatMessageA FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetLargePageMinimum LocalFree Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter VirtualFree VirtualProtect GetTimeZoneInformationForYear CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError CancelIo CancelIoEx CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DuplicateHandle FindClose FindFirstFileExW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount GetWindowsDirectoryW HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryA MapViewOfFile PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFile WriteFileEx CreateEventA CreateSemaphoreA DeleteCriticalSection EnterCriticalSection GetHandleInformation GetProcessAffinityMask GetSystemTimeAsFileTime GetThreadContext GetThreadPriority InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlUnwindEx SetEvent SetProcessAffinityMask SetThreadContext SetThreadPriority SuspendThread TryEnterCriticalSection VirtualQuery __C_specific_handler

user32

GetLastInputInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

combase

CoTaskMemFree

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

shell32

SHGetKnownFolderPath

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

api-ms-win-crt-convert-l1-1-0

mbsrtowcs strtoul

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fputc fputs fwrite _read

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp wcslen _strdup

api-ms-win-crt-utility-l1-1-0

rand_s

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

30KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_2483d141f75e850fe571dca288ef2ba1_akira_coinminer_glassworm_quasar-rat

advapi32

kernel32

user32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

combase

crypt32

ntdll

secur32

shell32

ws2_32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic