Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 04:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
General
- Target 2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe
- Size 66.6MB
- Sample260718-e5dneagt8p
- SHA256 ffe656b7b87864c8999d269bcc26863c803f7e3a3f35454296157a7b69a8b4d5
- MD5 273457b214471be422d15e489e220ff1
- SHA1 aee2e2123ab952ce7bbd1fc65fc73e8f91c9669b
- SHA512 37a25fd97553fd5c2c46fb8c654c132e86c9dbfcb82dda73f31e33af096cb3b98418bcf5fc795d105641ce78f3f72ddc01befa96fe12182590f7626aaf57d74d
- SSDEEP 786432:uEgkjhiilsqLEhxMJtoUcbLZN6U4HDX4RJq1qdWsyiBgq1q:uETdiN6gxdUW1N6Jyq1qGNq1q
- TLSH T105E75B13E6A310EDC5BFC231865BA372FA31784941347A6F1594DB352E31E60AB3E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral1/memory/2472-0-0x00007FF699190000-0x00007FF69D57B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/1828-4-0x00007FF699190000-0x00007FF69D57B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1828 2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe 1828 2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1828 wrote to memory of 2472 1828 2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_273457b214471be422d15e489e220ff1_akira_coinminer_glassworm_quasar-rat.exe2⤵PID:2472
-