2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat
Size 1.8MB
Sample260718-vcwlhsbt4w
SHA256 ff28cb27546895f894dc41f3a36da1ea828091ac1035a5dc900d6489a2d7526f
MD5 3d52084ed847ce821947ecfdb4ac2696
SHA1 6a8d1f6e4d37accc52612fe0867c1475e3c6f5ac
SHA512 1096aa12defd8289dda9b4d1d0381d76abc217e9b6520f29705d9029b730935a104353a38c0b64caecb79a9e9ddcb9b8a54ed2c6fa2388189933738bef33a757
SSDEEP 49152:zjUjwUExjomP5AegI9UAcPvFxHdotHUPQMmJvw/iLK8WIk:zjUE596o5qUk
TLSH
T195956B03E6A580FDD06AC170875AD333FA31B8891534BA5F2BA4DB213F25E609B5E75C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat

File Explorer

2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat

.exe 1.8MB

2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat

IMPHASH f2a7047e5f0f84609e09e1a7a2ab6799
SHA256 ff28cb27546895f894dc41f3a36da1ea828091ac1035a5dc900d6489a2d7526f
MD5 3d52084ed847ce821947ecfdb4ac2696
SHA1 6a8d1f6e4d37accc52612fe0867c1475e3c6f5ac
SHA512 1096aa12defd8289dda9b4d1d0381d76abc217e9b6520f29705d9029b730935a104353a38c0b64caecb79a9e9ddcb9b8a54ed2c6fa2388189933738bef33a757
SSDEEP 49152:zjUjwUExjomP5AegI9UAcPvFxHdotHUPQMmJvw/iLK8WIk:zjUE596o5qUk
TLSH
T195956B03E6A580FDD06AC170875AD333FA31B8891534BA5F2BA4DB213F25E609B5E75C
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f5:34:82:e0:b6:82:8d:e3:46:5d:ba:26:01:7e:1d:2e:7b:22:1f:22:a1:da:82:0a:ab:87:26:c3:c2:1e:57:33

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,ST=Washington,C=US

Chains

Jul 17, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

WaitOnAddress WakeByAddressAll WakeByAddressSingle AddVectoredExceptionHandler AreFileApisANSI CancelIo CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateProcessA CreateProcessW CreateThread GetSystemTimeAsFileTime DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetWindowsDirectoryW GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile GetVersionExW SetLastError MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadFile ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx __C_specific_handler

bcrypt

ProcessPrng BCryptGenRandom

advapi32

GetUserNameW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

comctl32

InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 abort atexit calloc exit fprintf free malloc memchr memcmp memcpy memmove memset qsort realloc signal strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoInitializeEx

shell32

SHGetFolderPathW

shlwapi

PathCombineW

user32

CloseClipboard DestroyWindow GetClipboardData GetCursorPos GetDC GetDesktopWindow GetSystemMetrics OpenClipboard ReleaseDC SendMessageA

version

GetFileVersionInfoSizeW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls$

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_3d52084ed847ce821947ecfdb4ac2696_akira_glassworm_quasar-rat

PE Signature issue

kernel32

bcrypt

advapi32

comctl32

gdi32

msvcrt

ntdll

ole32

shell32

shlwapi

user32

version

generic