xmrig | 2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat

Resubmissions

10/09/2026, 08:37

260910-kh7kvszhpg10

10/09/2026, 07:31

260910-jch5msga7910

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat
Size 7.6MB
Sample260910-kh7kvszhpg
SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
MD5 1045591681b11e496aec8bb417e6c1d3
SHA1 242ec85ff6d7fc1bf40d9edd9689b29a84386682
SHA512 f0acb708d58a60766f9487fd0cf0d746b12d1ea0b199a5122d3e986e2e6cd20c0df0f00bce909ce866171ca881abe97a7c84d1d3c81b82c1414830ba9278f96c
SSDEEP 98304:4aWmsmLcp3eOuvacXq1nVAusPnsc8EKtAmsbRAQSoEWIiPh+dK:jaVbEscWsl5p9
TLSH
T1E5866B43E2A290ECC16AC074835AA273FA32BC5D45357AAB5BD0DB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	family_xmrig_powershell_dropper

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat

File Explorer

2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat

.exe 7.6MB

2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat

IMPHASH 1b3681e7f4b185634c96688c4a663ba0
SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
MD5 1045591681b11e496aec8bb417e6c1d3
SHA1 242ec85ff6d7fc1bf40d9edd9689b29a84386682
SHA512 f0acb708d58a60766f9487fd0cf0d746b12d1ea0b199a5122d3e986e2e6cd20c0df0f00bce909ce866171ca881abe97a7c84d1d3c81b82c1414830ba9278f96c
SSDEEP 98304:4aWmsmLcp3eOuvacXq1nVAusPnsc8EKtAmsbRAQSoEWIiPh+dK:jaVbEscWsl5p9
TLSH
T1E5866B43E2A290ECC16AC074835AA273FA32BC5D45357AAB5BD0DB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlVirtualUnwind SetEnvironmentVariableW SetUnhandledExceptionFilter TryEnterCriticalSection WideCharToMultiByte lstrlenW GetTimeZoneInformationForYear SystemTimeToFileTime CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW GetLastError AreFileApisANSI CancelIo CancelIoEx CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileA DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FreeLibrary GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessId GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetVolumeInformationW GetWindowsDirectoryW GlobalMemoryStatusEx HeapCompact HeapCreate HeapDestroy HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus ReadFile ReadFileEx RtlLookupFunctionEntry SetConsoleTitleW SetEndOfFile SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnlockFileEx UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WriteConsoleW WriteFile WriteFileEx RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ole32

CoTaskMemFree

pdh

PdhCloseQuery PdhRemoveCounter

shell32

SHGetKnownFolderPath

user32

GetCursorPos

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW GetTokenInformation GetUserNameW OpenProcessToken SystemFunction036

oleaut32

GetErrorInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

iphlpapi

GetAdaptersAddresses GetIpForwardTable

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 abort atexit calloc exit fprintf free ldexp malloc memchr memcmp memcpy memmove memset qsort realloc signal strchr strcmp strcspn strlen strncmp strrchr strspn vfprintf

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat

ntdll

kernel32

ole32

pdh

shell32

user32

bcryptprimitives

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

bcrypt

crypt32

iphlpapi

secur32

ws2_32

msvcrt

generic