2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat
Size 4.0MB
Sample261009-2y8arsxt5p
SHA256 289a130400f3963b3b3da6f9ca45f7a68cd9b4f3aabc6fd3cd60f84dede7a19a
MD5 fff4736678137519bea9017b0513f268
SHA1 de8d850b610e9b49153621b9a431aac786aeb050
SHA512 c6f3e1b0495e12b93c37a4d762bed30ee359724883a2dc27bcc3e364e1a0f6cef751c34e5e82718093f7d7d2948fe5d6dc9b167fb399855e1818975926df6ee4
SSDEEP 49152:dQwHh+Ps4vxl0JRP8gerW7nXHOpnH8DGKd9uUXdcnjcsjAREt7ydPamoiXk2cw+O:bBOs4ceZBA1wmol2cwnfLhi+sA
TLSH
T1FE165B03D2A580E8C0AAC5B9C357A737FB71BC8D453472AB5BE44B212E69F905F0E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat

File Explorer

2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat

.exe 4.0MB

2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat

IMPHASH 2285a4c39911d062bad8a1893136f6e0
SHA256 289a130400f3963b3b3da6f9ca45f7a68cd9b4f3aabc6fd3cd60f84dede7a19a
MD5 fff4736678137519bea9017b0513f268
SHA1 de8d850b610e9b49153621b9a431aac786aeb050
SHA512 c6f3e1b0495e12b93c37a4d762bed30ee359724883a2dc27bcc3e364e1a0f6cef751c34e5e82718093f7d7d2948fe5d6dc9b167fb399855e1818975926df6ee4
SSDEEP 49152:dQwHh+Ps4vxl0JRP8gerW7nXHOpnH8DGKd9uUXdcnjcsjAREt7ydPamoiXk2cw+O:bBOs4ceZBA1wmol2cwnfLhi+sA
TLSH
T1FE165B03D2A580E8C0AAC5B9C357A737FB71BC8D453472AB5BE44B212E69F905F0E719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges ConvertSidToStringSidW CreateProcessAsUserW CreateProcessWithTokenW DuplicateTokenEx GetTokenInformation LookupAccountSidW LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RevertToSelf SetThreadToken SystemFunction036 CredBackupCredentials

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetDIBits PatBlt SelectObject

iphlpapi

GetAdaptersAddresses GetExtendedTcpTable GetExtendedUdpTable

kernel32

CancelIo CancelIoEx CloseHandle ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DisableThreadLibraryCalls DisconnectNamedPipe DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetTempPathW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LoadLibraryExA LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW ReadFile ReadFileEx RegisterWaitForSingleObject RemoveDirectoryW ResumeThread RtlLookupFunctionEntry SetFileCompletionNotificationModes SetFileInformationByHandle SetHandleInformation SetLastError SetNamedPipeHandleState SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFile WriteFileEx GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetWindowsDirectoryW AddVectoredExceptionHandler CompareStringOrdinal DeleteCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter __C_specific_handler

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile

oleaut32

SysFreeString SysStringLen

user32

AttachThreadInput CallNextHookEx CloseDesktop CreateDesktopW CreateWindowExW DefWindowProcW DestroyWindow EnumWindows GetForegroundWindow GetGUIThreadInfo GetMessageW GetSystemMetrics GetWindowDC GetWindowRect GetWindowTextW GetWindowThreadProcessId IsWindowVisible OpenDesktopW PostMessageW PostThreadMessageW RegisterClassW ReleaseDC SetActiveWindow SetFocus SetThreadDesktop SetWindowsHookExW ToUnicode UnhookWindowsHookEx

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf wcslen

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bsopsec

Size

512B

Virtual Size

402B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

772KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

277KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-09_fff4736678137519bea9017b0513f268_akira_cobalt-strike_glassworm_quasar-rat

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

gdi32

iphlpapi

kernel32

ntdll

oleaut32

user32

ws2_32

wtsapi32

secur32

msvcrt

generic