General
- Target 2026-08-01_1cc9b59964c70bcd40515c2ea4472d07_akira_glassworm_quasar-rat
- Size 1.5MB
- Sample260802-bky7tsbk5v
- SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
Score
10/10
Malware Config
Targets
-
- Target 2026-08-01_1cc9b59964c70bcd40515c2ea4472d07_akira_glassworm_quasar-rat
- Size 1.5MB
- SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Disables service(s)
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
2