2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat
Size 3.1MB
Sample260814-e1t5lavvat
SHA256 8e6ebf8091aba4b4688f515cd2bf17bef3686898e0905d782874a47b1d8beee1
MD5 56c931255217b8fd888da8c0491a73fe
SHA1 ea88c7789ee57b9566277a0ef8975125b169fd1f
SHA512 35d0e4c2e2bb736d85559e05d74e50adafa56d82bbc93f640aa077192784bb5aa079d61a9fe003cc8ba49709bd1bc02517035aa337cb0d370e1675541ee84f9a
SSDEEP 49152:hfsIOY03K1g2yI1BUlIh2I4px7SZccI0oTk0Lfu/EaIU6isj:pst647IL4px7uM0Z06/++s
TLSH
T17FE56B43FEA1D1E8C0D9C478CF465332AA22BC8D4520766B2BE476112EF6BE05F8D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat

File Explorer

2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat

.exe 3.1MB

2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat

IMPHASH a1c2104d1369988f2aee28c09382aeb9
SHA256 8e6ebf8091aba4b4688f515cd2bf17bef3686898e0905d782874a47b1d8beee1
MD5 56c931255217b8fd888da8c0491a73fe
SHA1 ea88c7789ee57b9566277a0ef8975125b169fd1f
SHA512 35d0e4c2e2bb736d85559e05d74e50adafa56d82bbc93f640aa077192784bb5aa079d61a9fe003cc8ba49709bd1bc02517035aa337cb0d370e1675541ee84f9a
SSDEEP 49152:hfsIOY03K1g2yI1BUlIh2I4px7SZccI0oTk0Lfu/EaIU6isj:pst647IL4px7uM0Z06/++s
TLSH
T17FE56B43FEA1D1E8C0D9C478CF465332AA22BC8D4520766B2BE476112EF6BE05F8D759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptGenRandom

kernel32

MultiByteToWideChar GetTimeZoneInformationForYear SetThreadErrorMode AddVectoredExceptionHandler CreateToolhelp32Snapshot GetComputerNameExW GetLogicalProcessorInformationEx GetSystemInfo GetSystemTimePreciseAsFileTime GetTickCount64 GlobalMemoryStatusEx Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter CloseHandle CreateFileMappingA CreateFileW CreateThread CreateWaitableTimerExW DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemTimes GetVolumeInformationW GetVolumePathNamesForVolumeNameW HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryA LoadLibraryExW LocalFree MapViewOfFile OpenProcess SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualQueryEx WaitForSingleObject WriteConsoleW FormatMessageW GetProcessHeap HeapAlloc HeapFree DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

bcryptprimitives

ProcessPrng

advapi32

GetCurrentHwProfileA GetUserNameW SystemFunction036 CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfTable2

netapi32

NetApiBufferFree NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ntdll

NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion RtlNtStatusToDosError NtReadFile NtWriteFile

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetPerformanceInfo

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockopt ioctlsocket recv select send setsockopt

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

combase

CoIncrementMTAUsage

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocString VariantClear SysAllocStringLen SysFreeString SysStringLen

shell32

CommandLineToArgvW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow realloc signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

996KB

Virtual Size

996KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_56c931255217b8fd888da8c0491a73fe_akira_glassworm_quasar-rat

bcrypt

kernel32

bcryptprimitives

advapi32

iphlpapi

netapi32

ntdll

pdh

powrprof

psapi

secur32

ws2_32

api-ms-win-core-synch-l1-2-0

combase

ole32

oleaut32

shell32

msvcrt

generic