2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm
Size 901KB
Sample260808-d6f99aswe1
SHA256 475157277e1af39d9fd28b3c55670ab0a68be03e33fd5961ab191186e7df6ffa
MD5 4fa4a356d79f238d0533b541117c32ff
SHA1 c134364162f0514f9cbf3107d764b853832dad72
SHA512 3babf1aa45c07ba09d7b1ab3fd44ba3e3f35b5d98bb8a09acd860bf73f63d72c7cfe26b611f89e5f080f0232594ddd5b282d708bfc1bc28d4c6a8aa5c2891bba
SSDEEP 12288:zccC6LvF+TQgqt5BXki1IcSusaRA2l9LwEssqnmrsHhC9IqLYomFsuoPEn0:zc/6Lv4cNP1uusaRX9c1sWC3Yom+ub
TLSH
T178157C47BAD991BCD15AC078C35B9633BA73B88A02317DBF03E496302E69E512F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm

File Explorer

2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm

.exe 901KB

2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm

IMPHASH 99338942e990575587f3b0cf8c392430
SHA256 475157277e1af39d9fd28b3c55670ab0a68be03e33fd5961ab191186e7df6ffa
MD5 4fa4a356d79f238d0533b541117c32ff
SHA1 c134364162f0514f9cbf3107d764b853832dad72
SHA512 3babf1aa45c07ba09d7b1ab3fd44ba3e3f35b5d98bb8a09acd860bf73f63d72c7cfe26b611f89e5f080f0232594ddd5b282d708bfc1bc28d4c6a8aa5c2891bba
SSDEEP 12288:zccC6LvF+TQgqt5BXki1IcSusaRA2l9LwEssqnmrsHhC9IqLYomFsuoPEn0:zc/6Lv4cNP1uusaRX9c1sWC3Yom+ub
TLSH
T178157C47BAD991BCD15AC078C35B9633BA73B88A02317DBF03E496302E69E512F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects ransomware indicator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal ConvertThreadToFiber CreateEventW CreateFiber CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFiber DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete K32GetPerformanceInfo LoadLibraryA LoadLibraryExA LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToFiber SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

netapi32

NetApiBufferFree NetGetJoinInformation

oleaut32

GetErrorInfo

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

user32

MessageBoxW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

341KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

520KB

Virtual Size

519KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm

ntdll

advapi32

bcrypt

kernel32

netapi32

oleaut32

pdh

powrprof

psapi

shell32

user32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic