2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat
Size 2.0MB
Sample261030-ta2jbaev6r
SHA256 5bfdc20093c03ee0a8fcf8558ad8bd97ea8ca009efe3a9a3c215ae0f3422e0e8
MD5 d4c1a6a78e1f388ad363af19c772855d
SHA1 63ff1bc6def0eeb43987ac793b8273e42258207a
SHA512 8ebebe470e1903a541e0665bcff7292f97cd6f1ac12b3364881ee4cd2ec3561230d2c5791da6b00c5d4043465edeb75f0d4ac33c8ed7028b9081309eb01d715d
SSDEEP 49152:rdoJ5AQYQOUIWAHE1MwBezWutEc0gyMWJTP6kuPJlkW18Q/lFTjN4:Czc0lcV1fLm
TLSH
T151A59E03E3A581ECC0AAC1798356A633FB71BC8A4934B6AF1BD45B213F65F50AB1D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat

File Explorer

2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat

.exe 2.0MB

2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat

IMPHASH f0f6b9a47a78a966756327d002bee099
SHA256 5bfdc20093c03ee0a8fcf8558ad8bd97ea8ca009efe3a9a3c215ae0f3422e0e8
MD5 d4c1a6a78e1f388ad363af19c772855d
SHA1 63ff1bc6def0eeb43987ac793b8273e42258207a
SHA512 8ebebe470e1903a541e0665bcff7292f97cd6f1ac12b3364881ee4cd2ec3561230d2c5791da6b00c5d4043465edeb75f0d4ac33c8ed7028b9081309eb01d715d
SSDEEP 49152:rdoJ5AQYQOUIWAHE1MwBezWutEc0gyMWJTP6kuPJlkW18Q/lFTjN4:Czc0lcV1fLm
TLSH
T151A59E03E3A581ECC0AAC1798356A633FB71BC8A4934B6AF1BD45B213F65F50AB1D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CancelIo DeleteCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetOverlappedResult GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetWindowsDirectoryW InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter VirtualProtect VirtualQuery WriteConsoleW WriteFileEx __C_specific_handler CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FreeLibrary GetApplicationUserModelId GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetTempPathW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryExA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenEventW OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW RemoveDirectoryW ResetEvent SetEvent SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte FormatMessageW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort atan2f calloc ceilf exit fmod fmodf fprintf free fwrite malloc memcmp memcpy memmove memset powf signal strlen strncmp vfprintf wcslen

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW

api-ms-win-appmodel-runtime-l1-1-1

VerifyApplicationUserModelId

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize RoUninitialize

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

bcryptprimitives

ProcessPrng

coremessaging

CreateDispatcherQueueController

crypt32

CertNameToStrW

d2d1

D2D1CreateFactory

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dwmapi

DwmFlush DwmGetWindowAttribute

dwrite

DWriteCreateFactory

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoIncrementMTAUsage CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

GetErrorInfo SafeArrayGetDim SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear

propsys

PropVariantToStringAlloc

shell32

SHCreateItemFromParsingName SHGetIDListFromObject SHGetKnownFolderItem SHGetPropertyStoreForWindow ShellExecuteExW ShellExecuteW

uiautomationcore

UiaHostProviderFromHwnd UiaRaiseAutomationEvent UiaRaiseNotificationEvent UiaRaiseStructureChangedEvent UiaReturnRawElementProvider

user32

AttachThreadInput BringWindowToTop CallNextHookEx CloseClipboard CloseDesktop CreateCursor CreateWindowExW DefWindowProcW DestroyCursor DestroyWindow DispatchMessageW EmptyClipboard EnumChildWindows EnumDisplayMonitors EnumWindows GetAncestor GetClassNameW GetClipboardData GetCursorPos GetDesktopWindow GetDpiForSystem GetDpiForWindow GetForegroundWindow GetMessageW GetMonitorInfoW GetSystemMetrics GetThreadDesktop GetTopWindow GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsIconic IsWindowVisible KillTimer MonitorFromPoint MonitorFromWindow NotifyWinEvent OpenClipboard OpenInputDesktop PeekMessageW PostThreadMessageW RegisterClassW SendInput SetActiveWindow SetClipboardData SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetProcessDPIAware SetProcessDpiAwarenessContext SetSystemCursor SetThreadDesktop SetThreadDpiAwarenessContext SetTimer SetWinEventHook SetWindowDisplayAffinity SetWindowLongPtrW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SwitchToThisWindow SystemParametersInfoW TranslateMessage UnhookWinEvent UnhookWindowsHookEx WaitForInputIdle WindowFromPoint keybd_event

version

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat

kernel32

msvcrt

ntdll

advapi32

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

bcryptprimitives

coremessaging

crypt32

d2d1

d3d11

dwmapi

dwrite

ole32

oleaut32

propsys

shell32

uiautomationcore

user32

version

winhttp

wintrust

generic