2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat
Size 3.6MB
Sample260723-aecafaxdpe
SHA256 06756d84a3594521989e7e6cc836713526195542d4bb1599d6228993f62fc09c
MD5 3bb833cc7a5392cff1a34cadfc844c82
SHA1 8e39522be20e77db6a17f492523aed584ddd86c2
SHA512 23c201ee5bf84a1ec51c00f68415d7a73473297f4693a19c481a88200c11064ee333d68f5cd4c9e93bb5d633f92374992a7a1eda555041248fcddc49f62ae285
SSDEEP 49152:12K7PoT/YinZH/JkdYJG/kNd9g3th4WGOjgpL3wEfvFxpfZ6Vcem/BM3N1tBQLf9:laYDsdZqt9XnG
TLSH
T110066B03FB9581E9C06EC178875A9333AA76F84D4620B65F6B94CB313E16F609F4E358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat

File Explorer

2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat

.exe 3.6MB

2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat

IMPHASH 9cc644486c4f02e5942ce531f323ebae
SHA256 06756d84a3594521989e7e6cc836713526195542d4bb1599d6228993f62fc09c
MD5 3bb833cc7a5392cff1a34cadfc844c82
SHA1 8e39522be20e77db6a17f492523aed584ddd86c2
SHA512 23c201ee5bf84a1ec51c00f68415d7a73473297f4693a19c481a88200c11064ee333d68f5cd4c9e93bb5d633f92374992a7a1eda555041248fcddc49f62ae285
SSDEEP 49152:12K7PoT/YinZH/JkdYJG/kNd9g3th4WGOjgpL3wEfvFxpfZ6Vcem/BM3N1tBQLf9:laYDsdZqt9XnG
TLSH
T110066B03FB9581E9C06EC178875A9333AA76F84D4620B65F6B94CB313E16F609F4E358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CancelIoEx CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GetWindowsDirectoryW GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFile WriteFileEx AreFileApisANSI CreateFileA CreateFileMappingW DeleteCriticalSection DeleteFileA EnterCriticalSection FlushFileBuffers FlushViewOfFile FormatMessageA GetCurrentProcessId GetDiskFreeSpaceA GetDiskFreeSpaceW GetFileAttributesA GetFileAttributesExW GetFileSize GetFullPathNameA GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTickCount GetVersionExA GetVersionExW HeapCompact HeapCreate HeapDestroy HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LockFile LockFileEx OutputDebugStringA OutputDebugStringW SetEndOfFile SetFilePointer SystemTimeToFileTime TryEnterCriticalSection UnlockFile UnlockFileEx WaitForSingleObjectEx WideCharToMultiByte

msvcrt

_XcptFilter __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fileno _fmode _fpreset _initterm _localtime64 _setmode abort atexit calloc exit fflush fprintf free malloc memchr memcmp memcpy memmove memset qsort realloc setvbuf strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW CredEnumerateW CredFree

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

user32

CloseClipboard GetClipboardData GetDesktopWindow GetSystemMetrics GetWindowDC IsClipboardFormatAvailable OpenClipboard ReleaseDC

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

821KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_3bb833cc7a5392cff1a34cadfc844c82_akira_glassworm_quasar-rat

kernel32

msvcrt

ntdll

advapi32

gdi32

user32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

crypt32

secur32

ws2_32

generic