2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat
Size 6.3MB
Sample260808-xcdrtack4v
SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
MD5 ed9cd259602788d5d1ea1dcda422acbb
SHA1 d0f8797766ed74a021aaa7fd72f2f94d1780d02d
SHA512 77191c8ab504ca98eee56a64df9f844cae8b000057be24ae5f98d20798eb7875066270925b3528d4068f8a60822afa2e8b8b51ce337729f3203e31d357d8a213
SSDEEP 98304:5BHQDmpLeZ2gJC3/R6djtc6tvMu4t4xpDts6jMdURy5+Hi:r2po3evA/VUK/
TLSH
T13E666B53F6A390ECC16AC1B4835AA232FE32B84945317AAB57D4CB313E52F506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat

File Explorer

2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat

.exe 6.3MB

2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat

IMPHASH 453b09958d233a5c360ed499d2fb13e7
SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
MD5 ed9cd259602788d5d1ea1dcda422acbb
SHA1 d0f8797766ed74a021aaa7fd72f2f94d1780d02d
SHA512 77191c8ab504ca98eee56a64df9f844cae8b000057be24ae5f98d20798eb7875066270925b3528d4068f8a60822afa2e8b8b51ce337729f3203e31d357d8a213
SSDEEP 98304:5BHQDmpLeZ2gJC3/R6djtc6tvMu4t4xpDts6jMdURy5+Hi:r2po3evA/VUK/
TLSH
T13E666B53F6A390ECC16AC1B4835AA232FE32B84945317AAB57D4CB313E52F506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036 GetTokenInformation OpenProcessToken

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

dwmapi

DwmFlush

gdi32

BitBlt CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GetDeviceCaps SelectObject

kernel32

AddVectoredExceptionHandler AreFileApisANSI CreateFileA CreateFileMappingA CreateFileMappingW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW GetCurrentDirectoryW GetCurrentProcessId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetModuleHandleW GetProcessHeap GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LockFile LockFileEx MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEndOfFile SetFilePointer SetUnhandledExceptionFilter SystemTimeToFileTime TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile WaitForSingleObjectEx WideCharToMultiByte GetModuleHandleA GetProcAddress CancelIoEx CloseHandle CopyFileExW CreateDirectoryW CreateFileW CreateIoCompletionPort CreateThread DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FreeLibrary GetComputerNameA GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentThread GetCurrentThreadId GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetQueuedCompletionStatusEx GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GlobalMemoryStatusEx InitOnceBeginInitialize InitOnceComplete LocalFree PostQueuedCompletionStatus ReadFile SetConsoleMode SetConsoleTextAttribute SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WriteConsoleW WriteFile RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

oleaut32

GetErrorInfo SysFreeString SysStringLen

user32

GetDC GetSystemMetrics ReleaseDC

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 _onexit abort calloc exit fprintf free fwrite ldexp malloc memchr memcmp memcpy memmove memset qsort realloc signal strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ed9cd259602788d5d1ea1dcda422acbb_akira_cobalt-strike_glassworm_quasar-rat

advapi32

bcrypt

crypt32

dwmapi

gdi32

kernel32

oleaut32

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

ws2_32

msvcrt

generic