2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer
Size 21.2MB
Sample260802-dlm73asscs
SHA256 4a64c5003749d3fe4eff72c28159da6318878cf608fa91f381a4d97fa4db673b
MD5 635560c0e489c31c7a93d7f863c8f717
SHA1 7bd3fd9e0586241b393391e2a8eb80fca989239b
SHA512 53ab15409ea6b88e26eb1fb72ff9f83d9ae1d2c4db119d8d9ec4bc7c5415b99a54a09f9fff41ea1b5e2f3635c0e7e622358b46df7c010e252d3cb243f77de1be
SSDEEP 196608:7QJfsV1Qox/t8TCCWGNFT68cBVdV/BXhv4l/6J:7z1Qk/teCEFT68cBVdVXv4lu
TLSH
T14127F721BA5B996CD05BC47483878A724A3170DB0B35B9BF44D496382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer

.exe 21.2MB

2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH a9d0637cdff29c9b185708d67db114b2
SHA256 4a64c5003749d3fe4eff72c28159da6318878cf608fa91f381a4d97fa4db673b
MD5 635560c0e489c31c7a93d7f863c8f717
SHA1 7bd3fd9e0586241b393391e2a8eb80fca989239b
SHA512 53ab15409ea6b88e26eb1fb72ff9f83d9ae1d2c4db119d8d9ec4bc7c5415b99a54a09f9fff41ea1b5e2f3635c0e7e622358b46df7c010e252d3cb243f77de1be
SSDEEP 196608:7QJfsV1Qox/t8TCCWGNFT68cBVdV/BXhv4l/6J:7z1Qk/teCEFT68cBVdVXv4lu
TLSH
T14127F721BA5B996CD05BC47483878A724A3170DB0B35B9BF44D496382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14668528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cluckers_central.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateMutexA CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EncodePointer ExitProcess FindClose FindFirstFileExW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetUserDefaultUILanguage GetUserPreferredUILanguages GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32GetPerformanceInfo LCIDToLocaleName LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW RtlLookupFunctionEntry RtlPcToFileHeader SetEnvironmentVariableW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shlwapi

SHCreateMemStream

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindow IsWindowEnabled IsWindowVisible LoadCursorW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shell32

CommandLineToArgvW DragFinish DragQueryFileW ILCreateFromPathW ILFree SHAppBarMessage SHCreateItemFromParsingName SHGetKnownFolderPath SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

advapi32

CopySid EventRegister EventSetInformation EventUnregister EventWriteTransfer GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW SystemFunction036

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlCaptureContext RtlGetVersion RtlNtStatusToDosError RtlUnwindEx RtlVirtualUnwind

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-string-l1-1-0

_wcsicmp strcmp strcpy_s strlen wcscmp wcslen wcsncat wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow round roundf trunc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

14.2MB

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

750KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

565B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_635560c0e489c31c7a93d7f863c8f717_akira_glassworm_quasar-rat_rusty-stealer

kernel32

ole32

comctl32

shlwapi

user32

gdi32

dwmapi

shell32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

combase

pdh

powrprof

ws2_32

secur32

crypt32

advapi32

ntdll

oleaut32

psapi

bcrypt

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic