2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat
Size 2.6MB
Sample260720-dc6ytac19l
SHA256 bee7d02806a1e84b72e6f15647f73b5d897736899fd22798995eaed6b61233dd
MD5 8b3a721d5e285d030a89d8fd1b88ab1b
SHA1 cbcd57c29f0da6b9f1d0dc5fef7279b79314dff1
SHA512 b4d20c4a8eaedf2474e4eb11ed0508982bfd2ba044561f0a33da05aa1d2344f9539aa04540350d40371dd128f7c26383135d796df54c7e4086ae3eecbba569e0
SSDEEP 24576:oqqEhAIQx7t5gfY2uz335wUF+03j1FJbaCpcB7fgWLcIrNwRzVIH06iy9FMXP:oIhWx7tmuzH5nkARFJuEW4eIBIU6isQ
TLSH
T1B4C57D03E79581EEC05FC078C3869732FA73B8890624B6AB67D09B353E66F805B1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat

File Explorer

2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat

.exe 2.6MB

2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat

IMPHASH d1d2a6564a80ec3f6049989196c9a313
SHA256 bee7d02806a1e84b72e6f15647f73b5d897736899fd22798995eaed6b61233dd
MD5 8b3a721d5e285d030a89d8fd1b88ab1b
SHA1 cbcd57c29f0da6b9f1d0dc5fef7279b79314dff1
SHA512 b4d20c4a8eaedf2474e4eb11ed0508982bfd2ba044561f0a33da05aa1d2344f9539aa04540350d40371dd128f7c26383135d796df54c7e4086ae3eecbba569e0
SSDEEP 24576:oqqEhAIQx7t5gfY2uz335wUF+03j1FJbaCpcB7fgWLcIrNwRzVIH06iy9FMXP:oIhWx7tmuzH5nkARFJuEW4eIBIU6isQ
TLSH
T1B4C57D03E79581EEC05FC078C3869732FA73B8890624B6AB67D09B353E66F805B1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036 CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcessHeap GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc K32GetPerformanceInfo LoadLibraryExA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter UnmapViewOfFile VirtualQueryEx GetModuleHandleA GetProcAddress CancelIo CloseHandle CreateEventW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread DeleteFileW DuplicateHandle FindClose FindFirstFileExW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemTimes InitOnceBeginInitialize InitOnceComplete LocalFree MoveFileExW OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetConsoleCtrlHandler SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx DeleteCriticalSection EnterCriticalSection GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler

oleaut32

GetErrorInfo SysFreeString SysStringLen

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

884KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_8b3a721d5e285d030a89d8fd1b88ab1b_akira_cobalt-strike_glassworm_quasar-rat

ntdll

advapi32

bcrypt

kernel32

oleaut32

pdh

powrprof

psapi

shell32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

msvcrt

generic