2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat
Size 2.8MB
Sample260728-g5ralsfe89
SHA256 ce6f08ab5ed4052f79ef065188694fca69781ee4c8acabb8ebc6a8dd76832e09
MD5 790f8dda37469fc68a657a322f014283
SHA1 561f2fa55d04e99d3bb0e59796c92fdfff412045
SHA512 c485c5e4cd760afa961ad314ca733f43afcd5cae7d0112e854589a7c1e4b7fa20a9bce2e37be3314062d530269a976cf421062cb11ec59829f7476b021e3a77d
SSDEEP 49152:2sqTjycSEQaoeRXfAKij/K1A64tPQoqEJ4px/xobBRqIj+No/EkPIU6isR:YyDGI7tIzi4pxpAqIad+sR
TLSH
T195D56C43F6A180ECC05AC1B8C71A9633EA36B88D093476FB6BD45B313E66F506B1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat

File Explorer

2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat

.exe 2.8MB

2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat

IMPHASH ab0670fdae6974cda42aaaaffbd71a03
SHA256 ce6f08ab5ed4052f79ef065188694fca69781ee4c8acabb8ebc6a8dd76832e09
MD5 790f8dda37469fc68a657a322f014283
SHA1 561f2fa55d04e99d3bb0e59796c92fdfff412045
SHA512 c485c5e4cd760afa961ad314ca733f43afcd5cae7d0112e854589a7c1e4b7fa20a9bce2e37be3314062d530269a976cf421062cb11ec59829f7476b021e3a77d
SSDEEP 49152:2sqTjycSEQaoeRXfAKij/K1A64tPQoqEJ4px/xobBRqIj+No/EkPIU6isR:YyDGI7tIzi4pxpAqIad+sR
TLSH
T195D56C43F6A180ECC05AC1B8C71A9633EA36B88D093476FB6BD45B313E66F506B1D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot ExpandEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter GetComputerNameExW CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError CancelIo CancelIoEx CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessId GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetVolumeInformationW GetWindowsDirectoryW GlobalMemoryStatusEx HeapReAlloc InitOnceBeginInitialize InitOnceComplete LocalFree MapViewOfFile MoveFileExW PostQueuedCompletionStatus ReadFile ReadFileEx RegisterWaitForSingleObject SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetThreadStackGuarantee Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UnregisterWaitEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFile WriteFileEx DeleteCriticalSection EnterCriticalSection GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx UnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler

shell32

IsUserAnAdmin ShellExecuteW

user32

GetDC GetSystemMetrics ReleaseDC

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _fpreset _initterm _onexit abort calloc ceilf exit floorf fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

692KB

Virtual Size

688KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_790f8dda37469fc68a657a322f014283_akira_cobalt-strike_glassworm_quasar-rat

gdi32

kernel32

shell32

user32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

ntdll

secur32

ws2_32

msvcrt

generic