2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer
Size 111.2MB
Sample260701-jp87labw4x
SHA256 f2e61619b0350386c74d2d7ee2cec6cc7bd1eb81f3aef0cb751b033825c5df57
MD5 b979fcb3165200f608d8632148a75ba2
SHA1 dbb8795b8396b0a64325270862c04e667b975102
SHA512 f14bfcd64a07eb87a9becb06859e4e1373b116064cfae81da6cd907e750ab8360b57e27fa97312ee1cd6b61cd9a4e55c3df2e7e2c9863cc3f622926398964137
SSDEEP 196608:nhWC+5HNvruhXRmyiQvKiYYHMupfMYALKMi:nhI5tzudRmyiGvHMu9h/M
TLSH
T1B348445495B447E98768267553327C5913EAD9E9C883249FC3A06BD52BFBF02E30E8F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer

File Explorer

2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer

.exe 111.2MB

2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer

IMPHASH 0f33964ad906155894894eb762af0351
SHA256 f2e61619b0350386c74d2d7ee2cec6cc7bd1eb81f3aef0cb751b033825c5df57
MD5 b979fcb3165200f608d8632148a75ba2
SHA1 dbb8795b8396b0a64325270862c04e667b975102
SHA512 f14bfcd64a07eb87a9becb06859e4e1373b116064cfae81da6cd907e750ab8360b57e27fa97312ee1cd6b61cd9a4e55c3df2e7e2c9863cc3f622926398964137
SSDEEP 196608:nhWC+5HNvruhXRmyiQvKiYYHMupfMYALKMi:nhI5tzudRmyiGvHMu9h/M
TLSH
T1B348445495B447E98768267553327C5913EAD9E9C883249FC3A06BD52BFBF02E30E8F0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5418820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

updater.pdb

kernel32

HeapReAlloc GetTimeZoneInformation GetDiskFreeSpaceExW LoadLibraryExW SetThreadErrorMode GetLogicalDrives GetFinalPathNameByHandleW GetQueuedCompletionStatusEx GlobalMemoryStatusEx ReadFile PostQueuedCompletionStatus WriteFile CancelIoEx GetTickCount64 CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemTimePreciseAsFileTime GetOverlappedResult FindClose GetModuleHandleA GetSystemInfo SetFilePointerEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext lstrlenW WideCharToMultiByte CreateToolhelp32Snapshot LoadLibraryA GetComputerNameExW FormatMessageW HeapAlloc HeapFree GetProcessHeap GetProcAddress GetProcessIoCounters GetSystemTimes CreateFileW GetProcessTimes GetModuleHandleW ExitProcess GetNativeSystemInfo VirtualQuery GetStdHandle GetConsoleMode GetConsoleOutputCP CreateEventW WriteConsoleW GetTempPathW GetModuleFileNameW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW SetFileInformationByHandle FindNextFileW CreateDirectoryW FindFirstFileExW SleepEx CreateThread DuplicateHandle CreateProcessW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetWaitableTimer ReadFileEx WriteFileEx CancelIo DeleteFileW CopyFileExW GetDriveTypeW GetVolumeInformationW DeviceIoControl ReadProcessMemory VirtualQueryEx CreateWaitableTimerExW SetHandleInformation Sleep SetLastError FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException GetCurrentThreadId SwitchToThread ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx QueryPerformanceCounter Process32FirstW Process32NextW GetCurrentThread SetThreadStackGuarantee TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter GetExitCodeProcess GetUserDefaultLocaleName AddVectoredExceptionHandler WaitForMultipleObjects OpenProcess GetCurrentProcess LocalFree SetUnhandledExceptionFilter MultiByteToWideChar GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObject FreeLibrary GetLastError CloseHandle DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection InitializeSListHead

advapi32

DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges GetTokenInformation RegOpenKeyExW LookupAccountSidW SetThreadToken RegQueryValueExW RegCloseKey IsValidSid GetLengthSid CopySid LookupPrivilegeValueW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtQuerySystemInformation NtQueryInformationProcess NtWriteFile NtReadFile NtCreateFile RtlGetVersion NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoInitializeEx CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantClear SysAllocString

powrprof

CallNtPowerInformation

user32

GetSystemMetrics ExitWindowsEx MessageBoxW

crypt32

CertAddCertificateContextToStore CertCloseStore CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertEnumCertificatesInStore CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateStore

bcryptprimitives

ProcessPrng

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey

secur32

DeleteSecurityContext ApplyControlToken AcquireCredentialsHandleA InitializeSecurityContextW DecryptMessage FreeContextBuffer FreeCredentialsHandle EncryptMessage QueryContextAttributesW LsaEnumerateLogonSessions LsaGetLogonSessionData AcceptSecurityContext LsaFreeReturnBuffer

ws2_32

bind ioctlsocket WSAIoctl setsockopt closesocket WSASocketW WSASend send recv getsockname connect getsockopt WSACleanup getpeername getaddrinfo freeaddrinfo shutdown WSAGetLastError WSAStartup

iphlpapi

GetIfTable2 FreeMibTable GetIfEntry2 GetAdaptersAddresses

psapi

GetModuleInformation EnumProcessModules GetModuleFileNameExW GetPerformanceInfo

netapi32

NetApiBufferFree NetUserEnum NetUserGetInfo NetUserGetLocalGroups

pdh

PdhCloseQuery PdhCollectQueryData PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA

shell32

CommandLineToArgvW

vcruntime140

memchr memcpy __CxxFrameHandler3 __current_exception __C_specific_handler strrchr memcmp memset memmove strchr __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen strcspn strncmp strlen strcmp strspn

api-ms-win-crt-math-l1-1-0

exp2 ceil log round log10 floor pow __setusermatherr

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode malloc free realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

exit _configure_narrow_argv __p___argc _initialize_narrow_environment _set_app_type _initialize_onexit_table _c_exit _exit _crt_atexit terminate _beginthreadex _endthreadex _seh_filter_exe _initterm_e _initterm _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _register_onexit_function _cexit __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_b979fcb3165200f608d8632148a75ba2_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

ole32

oleaut32

powrprof

user32

crypt32

bcryptprimitives

ncrypt

secur32

ws2_32

iphlpapi

psapi

netapi32

pdh

shell32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic