2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat
Size 2.7MB
Sample260722-3pg8nasxhs
SHA256 f42c30c3cd9dc0ca40ca71a5b435d15521351d222f4d62ff99e693213a28d289
MD5 7da5760f4a1b19005acf7ec040075cfe
SHA1 364254fccfd2e7700faf688ad62b9eff6327fadd
SHA512 111a4c2610f31d56a79e1b6c7fad413a85be4860d4a2ec679c455f23cf206a6690118be6d4423a87c373e5ee4069ddbbcd0c2efb5c82111f8a51c20b63b1a4d3
SSDEEP 49152:8i/WRk1aK3QrHrMSc377RbWUZTY8JYIHrE:ejL2YDIHrE
TLSH
T1D8D57C43F59149EDD99AC138871B9322BB367C490631B7B736946AF02E27B81AF1D334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat

File Explorer

2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat

.exe 2.7MB

2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat

IMPHASH 17f1c28416962e05b70efffc57ea116a
SHA256 f42c30c3cd9dc0ca40ca71a5b435d15521351d222f4d62ff99e693213a28d289
MD5 7da5760f4a1b19005acf7ec040075cfe
SHA1 364254fccfd2e7700faf688ad62b9eff6327fadd
SHA512 111a4c2610f31d56a79e1b6c7fad413a85be4860d4a2ec679c455f23cf206a6690118be6d4423a87c373e5ee4069ddbbcd0c2efb5c82111f8a51c20b63b1a4d3
SSDEEP 49152:8i/WRk1aK3QrHrMSc377RbWUZTY8JYIHrE:ejL2YDIHrE
TLSH
T1D8D57C43F59149EDD99AC138871B9322BB367C490631B7B736946AF02E27B81AF1D334
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetUserDefaultLocaleName Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter CancelIo CloseHandle CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryA MapViewOfFile MoveFileExW PostQueuedCompletionStatus ReadFile ReadFileEx RegisterWaitForSingleObject SetConsoleCtrlHandler SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UnregisterWaitEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown socket

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil floor log pow

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

537KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_7da5760f4a1b19005acf7ec040075cfe_akira_glassworm_quasar-rat

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

ntdll

secur32

ws2_32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic