2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat
Size 6.2MB
Sample260804-njwrjaac66
SHA256 429467fa585ec4f7e0c27495676a107226f3364e6770060c34e9b364c92fa8ac
MD5 6eb2ad53c53ceaf405b3c3bc28553c74
SHA1 7985528016d283b11cd66e3aacc6e1e792729cf6
SHA512 926928c03d6a59d0733e319ef4b5548f6f74b49c9581730a83432cceabdb769c17a7a7b6660c5c275b8d56951d970cacdf9344a7f78ffebdbb00b4d87946a631
SSDEEP 98304:r6jy+7u2wTM/Qto7v5kxIPkxawphUuvIFjO+JHd:rFzQvuGtdOQ
TLSH
T19E666C43F6A390EDC56BC074835AA233FA32B85905317AAB57D0CB313E52F60AE5DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat

File Explorer

2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat

.exe 6.2MB

2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat

IMPHASH e8e4498564684be844f0d38a9ad2734b
SHA256 429467fa585ec4f7e0c27495676a107226f3364e6770060c34e9b364c92fa8ac
MD5 6eb2ad53c53ceaf405b3c3bc28553c74
SHA1 7985528016d283b11cd66e3aacc6e1e792729cf6
SHA512 926928c03d6a59d0733e319ef4b5548f6f74b49c9581730a83432cceabdb769c17a7a7b6660c5c275b8d56951d970cacdf9344a7f78ffebdbb00b4d87946a631
SSDEEP 98304:r6jy+7u2wTM/Qto7v5kxIPkxawphUuvIFjO+JHd:rFzQvuGtdOQ
TLSH
T19E666C43F6A390EDC56BC074835AA233FA32B85905317AAB57D0CB313E52F60AE5DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetDIBits GetDeviceCaps GetObjectW SelectObject SetStretchBltMode StretchBlt

kernel32

AddVectoredExceptionHandler AreFileApisANSI CompareStringOrdinal CreateFileA CreateFileMappingA CreateFileMappingW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW GetCurrentDirectoryW GetCurrentProcessId GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileSize GetFullPathNameA GetModuleFileNameW GetModuleHandleW GetProcessHeap GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LockFile LockFileEx MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEndOfFile SetFilePointer SetUnhandledExceptionFilter SystemTimeToFileTime TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile WaitForSingleObjectEx WideCharToMultiByte lstrlenW GetTimeZoneInformationForYear GetModuleHandleA GetProcAddress CloseHandle CopyFileExW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FreeConsole FreeLibrary GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW InitOnceBeginInitialize InitOnceComplete LocalFree MoveFileExW PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WriteConsoleW WriteFile WriteFileEx RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ole32

CoTaskMemFree

oleaut32

GetErrorInfo SysFreeString SysStringLen

shell32

SHGetKnownFolderPath

user32

EnumDisplayMonitors EnumDisplaySettingsExW GetMonitorInfoW ShowWindow

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 abort atexit calloc ceil ceilf exit fprintf free ldexp malloc memchr memcmp memcpy memmove memset qsort realloc signal strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_6eb2ad53c53ceaf405b3c3bc28553c74_akira_glassworm_quasar-rat

advapi32

bcrypt

gdi32

kernel32

ole32

oleaut32

shell32

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

ws2_32

msvcrt

generic