2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer
Size 5.2MB
Sample260804-gr25yssejd
SHA256 46c2f6ed2eef0682d867d322c031b6de07026a94d8105707d20d02806f5e220f
MD5 a28b5542b7ff0a2d70bce927902d6d67
SHA1 782541c9f7414c29a43109d3b34e5ed4c3edcd88
SHA512 a864df5e8106b5f1b9e1387f387f843ca0715aff9aaef834581eb105c19ea8182f00cc2b96c565baa045de43829066e8d96fe7d13fc4e621995cd0968d8ca884
SSDEEP 98304:DaVTbrrxz3bHDQFpdJZ5fJsR+jEVTb2H24+PIYI0I7I7I7I:u1925fJsR+8bSQIYI0I7I7I7I
TLSH
T160463A43F6A391E8C169C075831A6232FB22BC4D47323AE71BD48B353E55BD06A7DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer

.exe 5.2MB

2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH ec170e25cfeb8df940c5a83edbc386f5
SHA256 46c2f6ed2eef0682d867d322c031b6de07026a94d8105707d20d02806f5e220f
MD5 a28b5542b7ff0a2d70bce927902d6d67
SHA1 782541c9f7414c29a43109d3b34e5ed4c3edcd88
SHA512 a864df5e8106b5f1b9e1387f387f843ca0715aff9aaef834581eb105c19ea8182f00cc2b96c565baa045de43829066e8d96fe7d13fc4e621995cd0968d8ca884
SSDEEP 98304:DaVTbrrxz3bHDQFpdJZ5fJsR+jEVTb2H24+PIYI0I7I7I7I:u1925fJsR+8bSQIYI0I7I7I7I
TLSH
T160463A43F6A391E8C169C075831A6232FB22BC4D47323AE71BD48B353E55BD06A7DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

41:e6:6e:ea:75:a6:c1:b7:38:e9:f8:e2:85:90:1f:bd:85:16:a1:82:6e:7e:57:d9:40:96:2a:50:2c:e1:fa:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,OU=Windows Security,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2026

CN=Microsoft Windows,OU=Windows Security,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

uxtheme

CloseThemeData GetThemeColor GetThemeMetric IsAppThemed IsThemeActive IsThemePartDefined

winmm

mciSendStringA mixerGetNumDevs timeBeginPeriod timeEndPeriod timeGetTime waveOutGetNumDevs

shcore

GetDpiForMonitor GetProcessDpiAwareness GetScaleFactorForMonitor SetProcessDpiAwareness

comctl32

InitCommonControlsEx LoadIconMetric TaskDialogIndirect

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CoCreateGuid CoCreateInstance CoGetClassObject CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

oleaut32

SafeArrayCreateVector SafeArrayDestroy SysAllocString SysFreeString SysStringLen VariantClear VariantCopy VariantInit

shlwapi

PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsDirectoryW PathStripPathW StrCmpIW StrStrIW

iphlpapi

GetAdaptersAddresses GetAdaptersInfo GetBestInterface GetIpStatistics GetNetworkParams GetTcpTable GetUdpTable

winspool.drv

ClosePrinter EnumPrintersW GetDefaultPrinterW OpenPrinterW

user32

CloseClipboard EmptyClipboard EnumWindows GetClipboardData GetDC GetDesktopWindow GetDpiForSystem GetDpiForWindow GetForegroundWindow GetMonitorInfoW GetSystemMetrics GetWindowTextLengthW IsClipboardFormatAvailable IsGUIThread LoadCursorW LockWorkStation MessageBoxW MonitorFromWindow OpenClipboard RegisterWindowMessageW ReleaseDC SetClipboardData SetCursor SetThreadDpiAwarenessContext SystemParametersInfoW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

CredEnumerateW CredFree GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetUserDefaultLocaleName GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetDllDirectoryW SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

shell32

ShellExecuteA

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt

libunwind

_GCC_specific_handler _Unwind_DeleteException _Unwind_GetDataRelBase _Unwind_GetIPInfo _Unwind_GetLanguageSpecificData _Unwind_GetRegionStart _Unwind_GetTextRelBase _Unwind_RaiseException _Unwind_Resume _Unwind_SetGR _Unwind_SetIP

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr log2 roundf

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _assert _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_a28b5542b7ff0a2d70bce927902d6d67_akira_glassworm_quasar-rat_rusty-stealer

PE Signature issue

dwmapi

uxtheme

winmm

shcore

comctl32

version

ole32

oleaut32

shlwapi

iphlpapi

winspool.drv

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

crypt32

gdi32

kernel32

ntdll

shell32

ws2_32

libunwind

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

generic