2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat
Size 2.3MB
Sample260805-31zbbayerb
SHA256 d5561fcb31f16deb0690e96bade6982d47e5aa6af84a4f6df1374bd54213ce72
MD5 a30c648207d7819af394c05a98bf1854
SHA1 5bdb4cc284cc16c876a1c275385a28c9137242dc
SHA512 2c6c46fc40f3a02849c7d2787222d92de243abb130f787910f307fa6504bdc004502e64618dedf6a7d28ea6440042eed0600bf2f43d5b79e4af66dabcd9c048b
SSDEEP 49152:aGRCq4rRAQknNlmlBTg9aSopTck6KTBMVtalnz:aBaQS9GYkz
TLSH
T122B56C43FBA986E9C29EC17C83565232BB36BC8D4620B79B27D40E313E56B605F4D748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat

File Explorer

2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat

.exe 2.3MB

2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat

IMPHASH 8e758afd0cb61121896dad007e37319a
SHA256 d5561fcb31f16deb0690e96bade6982d47e5aa6af84a4f6df1374bd54213ce72
MD5 a30c648207d7819af394c05a98bf1854
SHA1 5bdb4cc284cc16c876a1c275385a28c9137242dc
SHA512 2c6c46fc40f3a02849c7d2787222d92de243abb130f787910f307fa6504bdc004502e64618dedf6a7d28ea6440042eed0600bf2f43d5b79e4af66dabcd9c048b
SSDEEP 49152:aGRCq4rRAQknNlmlBTg9aSopTck6KTBMVtalnz:aBaQS9GYkz
TLSH
T122B56C43FBA986E9C29EC17C83565232BB36BC8D4620B79B27D40E313E56B605F4D748
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetStdHandle Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter WriteConsoleW CloseHandle CreateFileMappingA CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LocalFree MapViewOfFile PostQueuedCompletionStatus ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fflush fprintf free malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

810KB

Virtual Size

810KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_a30c648207d7819af394c05a98bf1854_akira_glassworm_quasar-rat

advapi32

kernel32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

ntdll

secur32

ws2_32

msvcrt

generic