2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat
Size 3.1MB
Sample260812-e14c9sydpg
SHA256 e28e5db8aebc0b24bfa97bc4df37ca635aa9721040876cc126491ba7e3b1a54b
MD5 c55a1a428098ab245e8e5669e00092e7
SHA1 599a8f0ffde37ce69c0ac9a3898f2a1e11112c75
SHA512 c310a9df820a68195e7135dd0356178e4167177168552460c1ae0eed5a507cf2ba1d401895030a080e27df5614209a9c7df46feabc4025fc006b93cedbea6c95
SSDEEP 49152:IyKZZoQ+yeyFVkpWYVTPgUATWO6alDY1/Qs/Vc2x2lsaeb:IdDV3iQqb
TLSH
T14EE56C03E6A580EDC46BC178C75AA733FA72B8894534B65F5BA4CB213E16F609F0E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat

File Explorer

2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat

.exe 3.1MB

2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat

IMPHASH 8d80b3f44c051eec704300f247ed376b
SHA256 e28e5db8aebc0b24bfa97bc4df37ca635aa9721040876cc126491ba7e3b1a54b
MD5 c55a1a428098ab245e8e5669e00092e7
SHA1 599a8f0ffde37ce69c0ac9a3898f2a1e11112c75
SHA512 c310a9df820a68195e7135dd0356178e4167177168552460c1ae0eed5a507cf2ba1d401895030a080e27df5614209a9c7df46feabc4025fc006b93cedbea6c95
SSDEEP 49152:IyKZZoQ+yeyFVkpWYVTPgUATWO6alDY1/Qs/Vc2x2lsaeb:IdDV3iQqb
TLSH
T14EE56C03E6A580EDC46BC178C75AA733FA72B8894534B65F5BA4CB213E16F609F0E315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler AddVectoredExceptionHandler AreFileApisANSI CompareStringOrdinal CreateFileA CreateFileMappingW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcessId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileSize GetFullPathNameA GetStdHandle GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTickCount HeapCompact HeapCreate HeapDestroy HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFilePointer SetUnhandledExceptionFilter SystemTimeToFileTime TryEnterCriticalSection UnlockFile UnlockFileEx WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW lstrlenW CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError LoadLibraryExA CancelIo CancelIoEx CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetQueuedCompletionStatusEx GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW GlobalMemoryStatusEx HeapReAlloc InitOnceBeginInitialize InitOnceComplete MapViewOfFile PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WriteFile WriteFileEx

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr fmin log log2

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _fileno _setmode fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strcspn strlen strncmp strspn

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-utility-l1-1-0

qsort

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

GetDC GetSystemMetrics ReleaseDC

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

oleaut32

SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

589KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c55a1a428098ab245e8e5669e00092e7_akira_glassworm_quasar-rat

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

gdi32

ole32

shell32

user32

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

crypt32

secur32

ws2_32

generic