2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer
Size 574KB
Sample260629-vqzkbsav21
SHA256 58c029ba04c94bebc4071376859bd6cceafe37df21d94e4fdf1fd10a028af9bf
MD5 2ea9ec08f706e4007e20babf94b05643
SHA1 e53973852c09536777e72b8d2ea0d0d1b299213c
SHA512 b13c12c6147ac19240bf82a16788002c2f02ae844fc530318674594e6a1a75566872d9abaeb374c25b061fa6ef2a00d41f0af74638dcfb7d4214a76f760ffd4f
SSDEEP 6144:kx7iQs6mG6bBFM2hco1nmngqKgta/N5DMUfZ39PY5DeKjYOPiypyj/:ktVmGkBFvegqKgw/N1MUfuVjtTw
TLSH
T1FBC46C17E69445FCC05AC03943569A77FA32B88A0B2075EB37DC12252F69ED92F3E718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer

File Explorer

2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer

.exe 574KB

2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer

IMPHASH 60d9b2969dad1c4a9aa8424c9e50e388
SHA256 58c029ba04c94bebc4071376859bd6cceafe37df21d94e4fdf1fd10a028af9bf
MD5 2ea9ec08f706e4007e20babf94b05643
SHA1 e53973852c09536777e72b8d2ea0d0d1b299213c
SHA512 b13c12c6147ac19240bf82a16788002c2f02ae844fc530318674594e6a1a75566872d9abaeb374c25b061fa6ef2a00d41f0af74638dcfb7d4214a76f760ffd4f
SSDEEP 6144:kx7iQs6mG6bBFM2hco1nmngqKgta/N5DMUfZ39PY5DeKjYOPiypyj/:ktVmGkBFvegqKgw/N1MUfuVjtTw
TLSH
T1FBC46C17E69445FCC05AC03943569A77FA32B88A0B2075EB37DC12252F69ED92F3E718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

ntdll

NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fputc setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

memset strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow roundf

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

mbrtowc wcrtomb

Name

.text

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.file

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.file_1c

Size

1024B

Virtual Size

525B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.file_e9

Size

1024B

Virtual Size

979B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_2ea9ec08f706e4007e20babf94b05643_akira_quasar-rat_rusty-stealer

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic