General
- Target 2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat
- Size 7.6MB
- Sample260910-jch5msga79
- SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
Score
10/10
Malware Config
Targets
-
- Target 2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat
- Size 7.6MB
- SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Clears Windows event logs
-
Detects command variations typically used by ransomware
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing virtualization MAC addresses
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
-
Drops file in Drivers directory
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.