2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat
Size 3.4MB
Sample261102-2prawsfy3k
SHA256 d6702a3576de4f0b69c0a439bf9a358d8e4fefef127a3123afa7b6f13cdc87dd
MD5 ca2eabc52d164f61d0d0343f8443b1e7
SHA1 6bbefa9a99d350929cb137e57befc44bb0265f0e
SHA512 2893a7c8b6a3e5f315e025d41d9595b428d1bf95cf5c906fca4e604d0de1e21cc109987b31d335d205bcc50a32d80e486dd2403e4e5225bea7f107b257ef71e2
SSDEEP 49152:we1Xo4BSDEoPsp5MktJCodbLy7zwtXWiHXFLvGnTnHwKrBefIU6isKNE:wnXE5ZEEXRvGbxIw+s1
TLSH
T1FBF54B43F6A681EDC0ADC1788356A233F732B88D493077AB2BE44B312E56B519F4D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat

File Explorer

2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat

.exe 3.4MB

2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat

IMPHASH 0ff505d813fb0967b00ad8dcbd13f4d1
SHA256 d6702a3576de4f0b69c0a439bf9a358d8e4fefef127a3123afa7b6f13cdc87dd
MD5 ca2eabc52d164f61d0d0343f8443b1e7
SHA1 6bbefa9a99d350929cb137e57befc44bb0265f0e
SHA512 2893a7c8b6a3e5f315e025d41d9595b428d1bf95cf5c906fca4e604d0de1e21cc109987b31d335d205bcc50a32d80e486dd2403e4e5225bea7f107b257ef71e2
SSDEEP 49152:we1Xo4BSDEoPsp5MktJCodbLy7zwtXWiHXFLvGnTnHwKrBefIU6isKNE:wnXE5ZEEXRvGbxIw+s1
TLSH
T1FBF54B43F6A681EDC0ADC1788356A233F732B88D493077AB2BE44B312E56B519F4D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects command variations typically used by ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptGenRandom

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

combase

CoTaskMemFree

kernel32

CloseHandle CompareStringOrdinal CopyFileExW DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW GlobalFree MoveFileExW MultiByteToWideChar SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError WideCharToMultiByte WriteConsoleW lstrlenW AddVectoredExceptionHandler CancelIo CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection EnterCriticalSection FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx RtlUnwindEx SetEnvironmentVariableW SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFileEx __C_specific_handler

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlAdjustPrivilege RtlCaptureContext RtlLookupFunctionEntry RtlSetProcessIsCritical RtlVirtualUnwind

shell32

SHGetKnownFolderPath

advapi32

GetUserNameW ImpersonateAnonymousToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf SystemFunction036

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr log pow trunc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

user32

CloseClipboard EmptyClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard SetClipboardData SystemParametersInfoW

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

952KB

Virtual Size

952KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat

bcrypt

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

combase

kernel32

ntdll

shell32

advapi32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic