18034205b16ca643a6ca114055f2e05858287a93086e60f9106f47d187e72c95

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
Size 6.8MB
Sample260905-wvb59sgk2x
SHA256 18034205b16ca643a6ca114055f2e05858287a93086e60f9106f47d187e72c95
MD5 112edf89e0b51f490bead94a81ea75ca
SHA1 70ecd00f49bbae3156dd2568f8ed9702d1865cb8
SHA512 05f7b0033798fdb265f769b7b5286e20b8d5239ee05b8bd548803dd58b14dee5e4e13daac3d616a24e68c7d75fba5b1f43fc3e49a23beb71ece6d69136b1a5b8
SSDEEP 49152:tpzQ1MUvIWb+5ZFDkB8X5U/hYth+PR53WYadpQfkPS/HUSiacIu3Bxt5nu5TaTYm:txJkKIeXMqDg/tu3BpuZHRt459ub5nUT
TLSH
T1E4666CA3B70605DDC66BD63EC5B75229F275338237226AAB194C9E356E43BC04E0E35C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detects executables using Telegram Chat Bot 3 IoCs

resource	yara_rule
behavioral2/memory/1748-0-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
behavioral2/memory/1748-5-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
behavioral2/memory/1748-320-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1736	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
1748	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4468	1748	2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe	92
PID 4468 wrote to memory of 1736	4468	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_112edf89e0b51f490bead94a81ea75ca_akira_glassworm_quasar-rat.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\wipe.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wipe.bat

Path C:\Users\Admin\AppData\Local\Temp\wipe.bat
Size 148B
SHA256 15ef88fd726eb082060ec2b33ebd8dc2db2757b80331f87ffdefa76e4ac13d0e
MD5 7c68dd42a4e3539b7c2e0c628b54a5c6
SHA1 1b8509eef1ca340eece379cc0cde9c71e47614f3
SHA512 591f59e09676e2816dd999dcf8fff5c240a88ce5e0fc95177178cf4b4e8a78e26cd833171bb8e98e90c703c0590af538a6d235b3fef2c85489385bbce3a1e27f
TLSH
T1DBC02B218139870604053035CAF3798D80C014CDE70093816230F90E344B84B39432C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1748-0-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp

Download

memory/1748-5-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp

Download

memory/1748-320-0x00007FF639AC0000-0x00007FF639F56000-memory.dmp

Download