General
- Target 2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat
- Size 7.6MB
- Sample260818-ft7msaem9y
- SHA256 f06dcdb4f1217da75276668a04fe2cbaacf540364484c913f8d935dfff509df7
Score
10/10
Malware Config
Targets
-
- Target 2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat
- Size 7.6MB
- SHA256 f06dcdb4f1217da75276668a04fe2cbaacf540364484c913f8d935dfff509df7
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Clears Windows event logs
-
Detects command variations typically used by ransomware
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
-
Drops file in Drivers directory
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.