2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat
Size 2.7MB
Sample260808-eqjwwazend
SHA256 986397dd3facc946d77851461c94835a97e85dee4b3a9cd13cd73591c3166391
MD5 0dc52780723a1e25442f662a9b926e67
SHA1 d8dc442af6bb9a1dcfe4ee67ce409d8811327ee9
SHA512 0df0705bd6d532450a12d3aa818683f384c531fad4440c981b71fc33b53ba58f32ebd1704565c7224319723f67ae50aa35cd128aa57bab37a84d445be679ba67
SSDEEP 49152:AXVskEGdkO1mmKRyRAOU64pxnTMzZwQ4j4dpk2aaIU6is:TDOsyd4pxTR+s
TLSH
T11FD56C03E6A581E8C06AC078C357A636FF72BCCE493476AF57D44B212E6AF50AB0D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat

File Explorer

2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat

.exe 2.7MB

2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat

IMPHASH 12627e125cbb6bc559a063fca4646068
SHA256 986397dd3facc946d77851461c94835a97e85dee4b3a9cd13cd73591c3166391
MD5 0dc52780723a1e25442f662a9b926e67
SHA1 d8dc442af6bb9a1dcfe4ee67ce409d8811327ee9
SHA512 0df0705bd6d532450a12d3aa818683f384c531fad4440c981b71fc33b53ba58f32ebd1704565c7224319723f67ae50aa35cd128aa57bab37a84d445be679ba67
SSDEEP 49152:AXVskEGdkO1mmKRyRAOU64pxnTMzZwQ4j4dpk2aaIU6is:TDOsyd4pxTR+s
TLSH
T11FD56C03E6A581E8C06AC078C357A636FF72BCCE493476AF57D44B212E6AF50AB0D715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegOpenKeyExW RegQueryValueExW CopySid CreateProcessWithTokenW DuplicateTokenEx GetLengthSid GetTokenInformation ImpersonateNamedPipeClient IsValidSid OpenProcessToken OpenThreadToken RevertToSelf SystemFunction036

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEnvironmentVariableW SetUnhandledExceptionFilter CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError LoadLibraryExA CancelIo CancelIoEx ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetWindowsDirectoryW HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LoadLibraryA LocalFree MapViewOfFile OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFile WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear GetErrorInfo SysAllocStringLen SysFreeString SysStringLen

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

winspool.drv

ClosePrinter FindFirstPrinterChangeNotification OpenPrinterW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

652KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_0dc52780723a1e25442f662a9b926e67_akira_glassworm_quasar-rat

ntdll

advapi32

kernel32

ole32

oleaut32

pdh

powrprof

psapi

shell32

winspool.drv

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

secur32

ws2_32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic