2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat
Size 16.2MB
Sample260820-cs1ajaba48
SHA256 7c9541b7fa210acbb05364e6c5ccb549572f0b8586a0ab3a12b022081d59db8c
MD5 e92f9c7f94ee54ca55a3efcf146ea1ec
SHA1 8263d54864b5f4a786825f4456f644efea665929
SHA512 f134f80024855a1721386d7d32012496b567365a91beb34a2829c3111f6106ab43bc47efb3794859165fb0f01ba255f6d22a76e3c921c6cfc50466f83e4a44d2
SSDEEP 196608:26IAAU6cVFRv79J12SwDmF/5zZpt9kx+1kft39q:vHV6M2cZpnw+2hM
TLSH
T179075D0677874DE6DCC63BB4A8AF233D9720FD316E294B2BA98D91341C532DC9D19B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat

File Explorer

2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat

.exe 16.2MB

2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat

IMPHASH 113e318f7a8887632dee7e64f9dcf086
SHA256 7c9541b7fa210acbb05364e6c5ccb549572f0b8586a0ab3a12b022081d59db8c
MD5 e92f9c7f94ee54ca55a3efcf146ea1ec
SHA1 8263d54864b5f4a786825f4456f644efea665929
SHA512 f134f80024855a1721386d7d32012496b567365a91beb34a2829c3111f6106ab43bc47efb3794859165fb0f01ba255f6d22a76e3c921c6cfc50466f83e4a44d2
SSDEEP 196608:26IAAU6cVFRv79J12SwDmF/5zZpt9kx+1kft39q:vHV6M2cZpnw+2hM
TLSH
T179075D0677874DE6DCC63BB4A8AF233D9720FD316E294B2BA98D91341C532DC9D19B90
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects command variations typically used by ransomware
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many IR and analysis tools
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfig2W ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService EnumServicesStatusExW GetUserNameA LookupPrivilegeValueA LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW RegSetValueExA RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject GetTextExtentPoint32A LineTo MoveToEx Rectangle SelectObject SetBkMode SetTextColor TextOutA

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileA CopyFileW CreateDirectoryA CreateEventA CreateFileA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FindFirstStreamW FindNextFileW FindNextStreamW FindResourceW FlushInstructionCache FormatMessageA FreeLibrary GetComputerNameA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeA GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFullPathNameW GetLastError GetLogicalDriveStringsA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource MoveFileExA MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryA RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesA SetFilePointerEx SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

mpr

WNetUseConnectionW

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtol strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 _fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler longjmp memchr memcmp memcpy memmove strchr strrchr wcsrchr wcsstr __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s _chsize_s _close _get_osfhandle _setmode _wfopen _wopen fclose fflush fopen_s fputc fputs fread fseek ftell fwrite setvbuf fopen _write _read _lseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype _strnicmp _wcsicmp isalnum isprint isspace memset strcmp strcoll strcpy_s strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcslen wcsnlen wcsxfrm wctype _stricmp _strdup

api-ms-win-crt-time-l1-1-0

_time64 _wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantClear VariantInit

shell32

SHGetFolderPathW

shlwapi

SHDeleteKeyW

user32

BeginPaint CallNextHookEx CreateWindowExA DefWindowProcA DispatchMessageA EndPaint FillRect FindWindowA FindWindowW GetAsyncKeyState GetClientRect GetMessageA GetSystemMetrics InvalidateRect LoadCursorA MessageBoxA PostMessageA PostQuitMessage RegisterClassA SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExA ShowWindow SystemParametersInfoW TranslateMessage UnhookWindowsHookEx wsprintfW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWriteData

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname gethostname htons inet_addr ioctlsocket recv select send socket

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

438KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat

advapi32

bcrypt

gdi32

iphlpapi

kernel32

mpr

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

netapi32

ole32

oleaut32

shell32

shlwapi

user32

winhttp

ws2_32

generic