2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer

Resubmissions

07/08/2026, 07:09

260807-hy758azbnd10

22/07/2026, 22:13

260722-148m2scg6510

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer
Size 4.7MB
Sample260722-148m2scg65
SHA256 d07ef415c1ddcb23e2b9305ab6a11d1e1bf27df28fa5468641245380c9e9c060
MD5 9563f394e819815af5579dd0aac60221
SHA1 e0ff0f97af3ba1ecbf6a97fe185877efb1caebac
SHA512 ad86c44f9b3e24cda5736847ce71ab0535e9f3abbf1d72127d60f9fb9fa6141fcf86ecd81d7edf431a7def50b65bcfb90b8fcebe30e47967c4521d1274ae0668
SSDEEP 49152:6KEOpFIu35agdGsqOoUwImyADjL+ShiPj6zDHuMVmaywQY2c03ReBh+NNe60o4bv:v1aVuCDHuq32c0Be36VCJS3wm+gm8+h
TLSH
T139367C03F695C1E8C0ADC178879B9733FA72F8894A20B69F17D44B212E56F906F5E718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many Password Manager software clients. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers

Detects executables referencing potentially confidential GIT artifacts. Observed in infostealer 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_GitConfData

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer

.exe 4.7MB

2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH 9b4255c9d771e067307dbf93b7d6119d
SHA256 d07ef415c1ddcb23e2b9305ab6a11d1e1bf27df28fa5468641245380c9e9c060
MD5 9563f394e819815af5579dd0aac60221
SHA1 e0ff0f97af3ba1ecbf6a97fe185877efb1caebac
SHA512 ad86c44f9b3e24cda5736847ce71ab0535e9f3abbf1d72127d60f9fb9fa6141fcf86ecd81d7edf431a7def50b65bcfb90b8fcebe30e47967c4521d1274ae0668
SSDEEP 49152:6KEOpFIu35agdGsqOoUwImyADjL+ShiPj6zDHuMVmaywQY2c03ReBh+NNe60o4bv:v1aVuCDHuq32c0Be36VCJS3wm+gm8+h
TLSH
T139367C03F695C1E8C0ADC178879B9733FA72F8894A20B69F17D44B212E56F906F5E718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables containing common artifacts observed in infostealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many Password Manager software clients. Observed in infostealers
Detects executables referencing potentially confidential GIT artifacts. Observed in infostealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

CredEnumerateW CredFree GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexW CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetUserDefaultLocaleName GetVersionExA GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetDllDirectoryW SetEndOfFile SetFileInformationByHandle SetFilePointer SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SystemTimeToFileTime TerminateProcess TlsGetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx __C_specific_handler

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

shell32

ShellExecuteA

user32

CloseClipboard EmptyClipboard GetClipboardData GetDC GetSystemMetrics IsClipboardFormatAvailable LockWorkStation MessageBoxW OpenClipboard ReleaseDC SetClipboardData

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr fmin log log2 roundf

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _assert _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fflush fwrite

api-ms-win-crt-string-l1-1-0

memset strcmp strcspn strlen strncmp strspn

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _localtime64 _tzset

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_9563f394e819815af5579dd0aac60221_akira_glassworm_quasar-rat_rusty-stealer

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

crypt32

gdi32

kernel32

ntdll

shell32

user32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic