General
- Target 2026-08-20_cd28173657f7ff9e4009c52656a15fad_glassworm_qilin_quasar-rat
- Size 16.2MB
- Sample260820-hjmkzatzft
- SHA256 77a91123ec512e4f19da951ab4f7393ab428d81963b6f72433ba1e1b320e0831
Score
10/10
Malware Config
Targets
-
- Target 2026-08-20_cd28173657f7ff9e4009c52656a15fad_glassworm_qilin_quasar-rat
- Size 16.2MB
- SHA256 77a91123ec512e4f19da951ab4f7393ab428d81963b6f72433ba1e1b320e0831
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Detects command variations typically used by ransomware
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables using Telegram Chat Bot
-
Enumerates VirtualBox registry keys
-
Renames multiple (5062) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks for VMWare services registry key.
-
Modifies Windows Firewall
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2