2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat
Size 2.9MB
Sample260909-ppa8fswaph
SHA256 15b161f90413dd194e910cad575e36f93fc4303207b169785c53f6f86d0b2d91
MD5 c1f0ac840aa46a604601776a4612bda9
SHA1 3b62de0ba022fbcb70c499ca1e9d59477cd96335
SHA512 38ba2b8f1e94be856bcedc87624e5044f3a60568d14b066d4f6f14c3e39028a9a091f2db80e40725baffae6edf0f567059bec51c2ca5d1c76c3177958104cef4
SSDEEP 49152:5ML4d0axt60tXV4zH+nFTY4G4QlKliQZH4IU6is:HbBZV4Gi4QlgFH+s
TLSH
T134E57D43F2A295ACC16AD0B8934BA632FB32BC9D46227BB717D087313E61B501F1DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat

File Explorer

2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat

.exe 2.9MB

2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat

IMPHASH 36cd9569722c0b1fc02e41ce31bd4a69
SHA256 15b161f90413dd194e910cad575e36f93fc4303207b169785c53f6f86d0b2d91
MD5 c1f0ac840aa46a604601776a4612bda9
SHA1 3b62de0ba022fbcb70c499ca1e9d59477cd96335
SHA512 38ba2b8f1e94be856bcedc87624e5044f3a60568d14b066d4f6f14c3e39028a9a091f2db80e40725baffae6edf0f567059bec51c2ca5d1c76c3177958104cef4
SSDEEP 49152:5ML4d0axt60tXV4zH+nFTY4G4QlKliQZH4IU6is:HbBZV4Gi4QlgFH+s
TLSH
T134E57D43F2A295ACC16AD0B8934BA632FB32BC9D46227BB717D087313E61B501F1DB55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateIoCompletionPort CreateThread CreateToolhelp32Snapshot DuplicateHandle ExitProcess FillConsoleOutputAttribute FillConsoleOutputCharacterA FormatMessageW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency SetConsoleCursorPosition SetConsoleMode SetFileCompletionNotificationModes SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtWriteFile RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

Name

.text

Size

2.0MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

804KB

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_c1f0ac840aa46a604601776a4612bda9_akira_glassworm_quasar-rat

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

msvcrt

ntdll

generic