2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat
Size 2.2MB
Sample260727-ebecvaverh
SHA256 df98bb33bcd796ec7a9570a5f23d8173efaff982407444799555c8be0d3e8e88
MD5 7d0846393ba220ebe2ce3bcad6ce31e7
SHA1 54a4d2a775b4140724abdb746286d338d6fc538e
SHA512 02a0c7bcae72642818792b20b095e1ba7aa0fbf0cdcba5c48ef62db4267dc7a6b900828880c300a1d466ca6a5d4fb818236fd76ee57d056e49f4bec508210d42
SSDEEP 49152:/IcobmSBSIy6Eq06upX0jDdKAERXIlIU6is:/gIq06aX+s
TLSH
T1DFB57C43F6A290EDC55AC078D34AA233FA32BC8D0635B9A757D0DB303E66F506A1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat

File Explorer

2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat

.exe 2.2MB

2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat

IMPHASH 110fb5dd8ed5b171f14d8e5ea963043f
SHA256 df98bb33bcd796ec7a9570a5f23d8173efaff982407444799555c8be0d3e8e88
MD5 7d0846393ba220ebe2ce3bcad6ce31e7
SHA1 54a4d2a775b4140724abdb746286d338d6fc538e
SHA512 02a0c7bcae72642818792b20b095e1ba7aa0fbf0cdcba5c48ef62db4267dc7a6b900828880c300a1d466ca6a5d4fb818236fd76ee57d056e49f4bec508210d42
SSDEEP 49152:/IcobmSBSIy6Eq06upX0jDdKAERXIlIU6is:/gIq06aX+s
TLSH
T1DFB57C43F6A290EDC55AC078D34AA233FA32BC8D0635B9A757D0DB303E66F506A1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter UnmapViewOfFile WriteConsoleW CloseHandle CreateDirectoryW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DuplicateHandle FindClose FindFirstFileExW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetQueuedCompletionStatusEx GetTempPathW InitOnceBeginInitialize InitOnceComplete PostQueuedCompletionStatus ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fprintf free malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

588KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat

advapi32

bcrypt

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

ws2_32

msvcrt

generic