2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink
Size 39.3MB
Sample260705-gxpf2sat91
SHA256 9aae5102c472fbc53eec8deec2ec1a2e5fcb658ccb692a1be99c1723840a1245
MD5 56902bef58146fed05f032d9963ca9c0
SHA1 39a6096c84c78d955c2cdd539bb17bf9240c04df
SHA512 bb35035edaedd86fa6ae0b382db7eea9bf243870094a7fe30991985a0aed0b82df9503f6d676483911aacf6c47f3abd9313b65ae1d71e0daae45671af6206d2d
SSDEEP 393216:G7GgXaCnncMX4/lJT2cTktHGw7hZORrCpBX5b3tP:G7la+nPE3T2c+Z7+BCpBXN3tP
TLSH
T1309718167A5B98ADD19AC870834A8A735F2130DB0B36B9FF40D486353F6DBF45B28358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink

File Explorer

2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink

.exe 39.3MB

2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink

IMPHASH 8bad6282de5a1814e1989043d22bcba1
SHA256 9aae5102c472fbc53eec8deec2ec1a2e5fcb658ccb692a1be99c1723840a1245
MD5 56902bef58146fed05f032d9963ca9c0
SHA1 39a6096c84c78d955c2cdd539bb17bf9240c04df
SHA512 bb35035edaedd86fa6ae0b382db7eea9bf243870094a7fe30991985a0aed0b82df9503f6d676483911aacf6c47f3abd9313b65ae1d71e0daae45671af6206d2d
SSDEEP 393216:G7GgXaCnncMX4/lJT2cTktHGw7hZORrCpBX5b3tP:G7la+nPE3T2c+Z7+BCpBXN3tP
TLSH
T1309718167A5B98ADD19AC870834A8A735F2130DB0B36B9FF40D486353F6DBF45B28358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31072320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

turbo.pdb

bcryptprimitives

ProcessPrng

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject AttachConsole CancelIo CancelIoEx CloseHandle CompareStringOrdinal CopyFileExW CreateConsoleScreenBuffer CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreatePipe CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileExW FindNextFileW FlushProcessWriteBuffers FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GenerateConsoleCtrlEvent GetCommandLineW GetComputerNameExW GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNamedPipeInfo GetNativeSystemInfo GetNumberOfConsoleInputEvents GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetTimeZoneInformationForYear GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleFileNameExW LoadLibraryA LoadLibraryW LocalFree MapViewOfFile Module32First Module32Next MoveFileExW MultiByteToWideChar OpenProcess OpenThread PostQueuedCompletionStatus Process32First Process32Next QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile ReadFileEx ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResumeThread RtlLookupFunctionEntry SetConsoleActiveScreenBuffer SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateJobObject TerminateProcess Thread32First Thread32Next TlsAlloc TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

user32

CloseClipboard EmptyClipboard GetForegroundWindow GetKeyboardLayout GetSystemMetrics GetWindowThreadProcessId OpenClipboard SetClipboardData ToUnicodeEx

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW EqualSid GetNamedSecurityInfoW GetSecurityDescriptorDacl GetTokenInformation ImpersonateAnonymousToken LookupAccountSidW OpenProcessToken RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW RevertToSelf SetNamedSecurityInfoW SystemFunction036

oleaut32

SysAllocString SysFreeString VariantClear

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown socket

ntdll

NtAllocateVirtualMemory NtCancelIoFileEx NtClose NtCreateFile NtCreateNamedPipeFile NtCreateSection NtDeviceIoControlFile NtFreeVirtualMemory NtLockFile NtMapViewOfSection NtOpenFile NtQueryInformationFile NtQueryInformationProcess NtQueryObject NtQuerySystemInformation NtQueryVolumeInformationFile NtReadFile NtSetInformationFile NtUnmapViewOfSection NtWriteFile RtlCaptureContext RtlEqualUnicodeString RtlGetFullPathName_U RtlGetVersion RtlNtStatusToDosError RtlQueryPerformanceCounter RtlQueryPerformanceFrequency RtlVirtualUnwind RtlWaitOnAddress

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

powrprof

CallNtPowerInformation

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

netapi32

NetApiBufferFree NetUserEnum NetUserGetLocalGroups

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity

userenv

GetUserProfileDirectoryW

psapi

GetModuleFileNameExW GetPerformanceInfo

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_terminate memchr strchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _fileno _read _set_fmode _setmode fclose feof ferror fflush fgets fopen fread fseek ftell fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _wassert abort exit strerror terminate

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode free malloc realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strcmp strlen wcslen

Name

.text

Size

30.5MB

Virtual Size

30.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_56902bef58146fed05f032d9963ca9c0_akira_glassworm_quasar-rat_rusty-stealer_voidlink

bcryptprimitives

kernel32

user32

advapi32

oleaut32

ws2_32

ntdll

api-ms-win-core-synch-l1-2-0

powrprof

ole32

shell32

iphlpapi

secur32

netapi32

pdh

shlwapi

bcrypt

crypt32

userenv

psapi

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic