General
- Target 2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat
- Size 16.2MB
- Sample260820-cs1ajaba48
- SHA256 7c9541b7fa210acbb05364e6c5ccb549572f0b8586a0ab3a12b022081d59db8c
Score
10/10
Malware Config
Targets
-
- Target 2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat
- Size 16.2MB
- SHA256 7c9541b7fa210acbb05364e6c5ccb549572f0b8586a0ab3a12b022081d59db8c
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Detects command variations typically used by ransomware
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables using Telegram Chat Bot
-
Enumerates VirtualBox registry keys
-
Renames multiple (227) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks for VMWare services registry key.
-
Modifies Windows Firewall
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1