2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat
Size 10.6MB
Sample260804-3c9gdashmf
SHA256 e88c83bd22a7b2e7ab62deefbdb7a52dba0b30675fe7b7dfcb2d8b2987898119
MD5 12b3c112da458912253d9d638271bdc1
SHA1 fc3848c52749a8aaf2f3f2c2473e423d57ac3023
SHA512 d659b3e7642be9ec3d109c123466e7ac739d0973fe295c6560844e10572a8cdc03e6065e641bb3fb96d197c8b3b1ebdddd4193d0632fbe302221967f04edbe21
SSDEEP 98304:fce8obgkmzaGdp8ppEe2P2HjiZ/Gq/42g7+st20WzFlSYHZYP1Xzhp0:J5hzx62Do/42g7bMBlJYP1A
TLSH
T14CB67D02E174055CCA9AE63587AFB339BA7939854532FAFF0D6296303C23B83971DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat

File Explorer

2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat

.exe 10.6MB

2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat

IMPHASH 305081532d747f93109f24c650c3f548
SHA256 e88c83bd22a7b2e7ab62deefbdb7a52dba0b30675fe7b7dfcb2d8b2987898119
MD5 12b3c112da458912253d9d638271bdc1
SHA1 fc3848c52749a8aaf2f3f2c2473e423d57ac3023
SHA512 d659b3e7642be9ec3d109c123466e7ac739d0973fe295c6560844e10572a8cdc03e6065e641bb3fb96d197c8b3b1ebdddd4193d0632fbe302221967f04edbe21
SSDEEP 98304:fce8obgkmzaGdp8ppEe2P2HjiZ/Gq/42g7+st20WzFlSYHZYP1Xzhp0:J5hzx62Do/42g7bMBlJYP1A
TLSH
T14CB67D02E174055CCA9AE63587AFB339BA7939854532FAFF0D6296303C23B83971DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtCreateFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FreeEnvironmentStringsW GetCommandLineW GetComputerNameExW GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleW GetOverlappedResult GetProcessId GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList K32GetPerformanceInfo LocalAlloc LocalFree LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReadProcessMemory RegisterWaitForSingleObject RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree UnlockFile UnmapViewOfFile UpdateProcThreadAttribute VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW CloseHandle DeleteCriticalSection EnterCriticalSection FreeLibrary GetConsoleWindow GetModuleHandleA GetProcAddress HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA RaiseException RtlUnwindEx SetUnhandledExceptionFilter Sleep TlsGetValue TlsSetValue VirtualProtect VirtualQuery __C_specific_handler GetTimeZoneInformationForYear FormatMessageW GetLastError LoadLibraryExA GetProcessHeap HeapAlloc GetConsoleMode GetConsoleScreenBufferInfo SetConsoleMode SetConsoleTextAttribute

netapi32

NetApiBufferFree NetGroupEnum NetGroupGetInfo NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SafeArrayAccessData SafeArrayDestroy SafeArrayUnaccessData SysAllocString VariantClear VariantCopy GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

pdh

PdhAddEnglishCounterA PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhCollectQueryDataEx PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

propsys

VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToUInt16 VariantToUInt32 VariantToUInt64

psapi

GetModuleFileNameExW GetProcessMemoryInfo

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

shell32

CommandLineToArgvW

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

ConvertSidToStringSidW ConvertStringSidToSidW CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr fmaf trunc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

shlwapi

AssocQueryStringW

user32

ShowWindow

bcryptprimitives

ProcessPrng

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_12b3c112da458912253d9d638271bdc1_akira_glassworm_quasar-rat

ntdll

iphlpapi

kernel32

netapi32

ole32

oleaut32

pdh

powrprof

propsys

psapi

secur32

shell32

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

advapi32

bcrypt

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shlwapi

user32

bcryptprimitives

api-ms-win-core-winrt-error-l1-1-0

generic