2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat
Size 9.6MB
Sample260731-c1mdmsbd36
SHA256 3f68ac85cb92d6bb803e1787f57eee7b4156eef706be65f3499cce4481ba5206
MD5 cd4df81783cf716ac53b4269cd2aba51
SHA1 2173e701473dd0201575fcd9ab6a9bbce39904ef
SHA512 f8424dbef857a710a6ed0c1399b3199a26507489a4315fe879c08d4949bd9e86c029da94415f9893a6ce66b6a083c74bac4cf2009b6107bbab6b99127bb4be75
SSDEEP 98304:HXc+a19vqQ7/vGvEfDYB9hnELBElvweC/1bfzRE:3g0t4BElYeCtu
TLSH
T134A67C53F61509DEC65BC23989B9223AB331B29922216FFB0D5C8E75AE137D18F1835C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat

File Explorer

2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat

.exe 9.6MB

2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat

IMPHASH 0074ade545161bc0c5490bc99c5ef08b
SHA256 3f68ac85cb92d6bb803e1787f57eee7b4156eef706be65f3499cce4481ba5206
MD5 cd4df81783cf716ac53b4269cd2aba51
SHA1 2173e701473dd0201575fcd9ab6a9bbce39904ef
SHA512 f8424dbef857a710a6ed0c1399b3199a26507489a4315fe879c08d4949bd9e86c029da94415f9893a6ce66b6a083c74bac4cf2009b6107bbab6b99127bb4be75
SSDEEP 98304:HXc+a19vqQ7/vGvEfDYB9hnELBElvweC/1bfzRE:3g0t4BElYeCtu
TLSH
T134A67C53F61509DEC65BC23989B9223AB331B29922216FFB0D5C8E75AE137D18F1835C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery AddVectoredExceptionHandler CancelIo CancelIoEx CompareStringOrdinal ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateIoCompletionPort CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleW GetNamedPipeInfo GetOverlappedResult GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LocalFree LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx RegisterWaitForSingleObject RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW CloseHandle GetModuleHandleA GetProcAddress Sleep

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

CryptAcquireContextW CryptDestroyKey CryptImportKey CryptReleaseContext RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CertAddCertificateContextToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCTLEntryFromCertificateContextProperties CertCreateCertificateContext CertDeleteCertificateFromStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptDecodeObjectEx CryptEncodeObjectEx CryptHashCertificate CryptMsgEncodeAndSignCTL CryptStringToBinaryA CryptUnprotectData PFXExportCertStore PFXImportCertStore

ncrypt

NCryptFreeObject

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

366KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_cd4df81783cf716ac53b4269cd2aba51_akira_glassworm_quasar-rat

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

advapi32

bcrypt

crypt32

ncrypt

secur32

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

generic