2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat
Size 3.6MB
Sample260727-jve6psytex
SHA256 f55e174778340f98d96ba1308a8fb285740af13da3cb95a469e5f0fe3774bf78
MD5 c085efc2cccb31173cefc5697112efe2
SHA1 c15a7bee73773f863e1d38fda322bdc808f8e81a
SHA512 56f8014281d964574f0062e92752f63cbe226382235372ded908acb344d2f6b01a67feb9f27885538ac9371ce912eeb69ea3124d2747bac47874713d69fd022a
SSDEEP 49152:5z7oeAc9GJc6BKKZ1KNMiwGu0hT8k1aMseQ9hybZV/iCW9gYUoYtzIU6is3:q1oIV9kZYUPS+s
TLSH
T1EC067D03FA9281EAC05EC1788757A333F732B8894920B79B2BD48B312E56F615F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat

File Explorer

2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat

.exe 3.6MB

2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat

IMPHASH a6dd70b59b47d447052cd41ebea23676
SHA256 f55e174778340f98d96ba1308a8fb285740af13da3cb95a469e5f0fe3774bf78
MD5 c085efc2cccb31173cefc5697112efe2
SHA1 c15a7bee73773f863e1d38fda322bdc808f8e81a
SHA512 56f8014281d964574f0062e92752f63cbe226382235372ded908acb344d2f6b01a67feb9f27885538ac9371ce912eeb69ea3124d2747bac47874713d69fd022a
SSDEEP 49152:5z7oeAc9GJc6BKKZ1KNMiwGu0hT8k1aMseQ9hybZV/iCW9gYUoYtzIU6is3:q1oIV9kZYUPS+s
TLSH
T1EC067D03FA9281EAC05EC1788757A333F732B8894920B79B2BD48B312E56F615F4D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

kernel32

AddVectoredExceptionHandler CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageA FormatMessageW GetCurrentDirectoryW GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter SystemTimeToFileTime TryEnterCriticalSection WideCharToMultiByte AreFileApisANSI CloseHandle CopyFileExW CreateDirectoryW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateThread CreateWaitableTimerExW DeleteFileA DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile PostQueuedCompletionStatus ReadFile SetEndOfFile SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnlockFileEx UnmapViewOfFile WaitForSingleObject WaitForSingleObjectEx WriteConsoleW WriteFile RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

userenv

GetUserProfileDirectoryW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtReadFile NtWriteFile RtlNtStatusToDosError

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _fmode _fpreset _initterm _localtime64 _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset realloc signal strcmp strcspn strlen strncmp strrchr vfprintf

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1005KB

Virtual Size

1005KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_c085efc2cccb31173cefc5697112efe2_akira_cobalt-strike_glassworm_quasar-rat

advapi32

kernel32

userenv

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

ntdll

secur32

ws2_32

msvcrt

generic