2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer
Size 8.4MB
Sample260808-d5kahszakf
SHA256 0daf606123eea2ce3a1b5b11db53f011f4d6d1342666119c9e3025d0417e4674
MD5 54d21dbe9ee1a7566cd5079efb56cb3c
SHA1 f490f2a33145632b6ceb992e3f494ddd5a6f6cf0
SHA512 a28f58aa06cee5300a1639f649d3a5de1453e7fd8feee3106c5acbf69c345078537a2dc2eb0bd497f022af8446c715d0c44f4deccb8d21e28947a21412169667
SSDEEP 98304:GH6rsQ55dtK7Wwj5EtwZ9grdPy2xz+X+qMPW:L5dZuANtP
TLSH
T1399627217A9A99ECD15AC474C34A8A732E6130CB0B36B9FF44D456383E69AF16F3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer

File Explorer

2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer

.exe 8.4MB

2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer

IMPHASH 8d67e5130db7f58d3806da56a7800aa0
SHA256 0daf606123eea2ce3a1b5b11db53f011f4d6d1342666119c9e3025d0417e4674
MD5 54d21dbe9ee1a7566cd5079efb56cb3c
SHA1 f490f2a33145632b6ceb992e3f494ddd5a6f6cf0
SHA512 a28f58aa06cee5300a1639f649d3a5de1453e7fd8feee3106c5acbf69c345078537a2dc2eb0bd497f022af8446c715d0c44f4deccb8d21e28947a21412169667
SSDEEP 98304:GH6rsQ55dtK7Wwj5EtwZ9grdPy2xz+X+qMPW:L5dZuANtP
TLSH
T1399627217A9A99ECD15AC474C34A8A732E6130CB0B36B9FF44D456383E69AF16F3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6215212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_windows_sandbox_setup.pdb

kernel32

VirtualProtect FlsFree HeapSize SetFileCompletionNotificationModes CreateIoCompletionPort FlushFileBuffers FlsSetValue GetSystemInfo GetNativeSystemInfo FlsGetValue HeapAlloc GetLastError FormatMessageW GetStringTypeW GetFileType SetStdHandle LoadLibraryExA CreateMutexW OpenMutexW FindClose ReleaseMutex CreateFileW LocalFree GetModuleHandleW GetCPInfo CompareStringOrdinal GetOEMCP ReadFileEx SleepEx WriteFileEx SetLastError GetFullPathNameW GetACP GetCurrentThreadId WaitForSingleObject SetHandleInformation IsValidCodePage SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetStdHandle GetCurrentProcess DuplicateHandle CreateDirectoryW SetFilePointerEx SetThreadStackGuarantee GetCurrentThread lstrlenW GetModuleHandleExW FindFirstFileExW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA GetFinalPathNameByHandleW DeleteFileW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleFileNameW ExitProcess LoadLibraryExW FreeLibrary FindNextFileW CreateThread SwitchToThread TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer CompareStringW LCMapStringW CancelIoEx WriteFile ReadFile GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime HeapReAlloc GetTimeZoneInformationForYear Sleep CloseHandle HeapFree GetProcessHeap GetProcAddress GetModuleHandleA FlsAlloc GetComputerNameExW RaiseException RtlPcToFileHeader TerminateProcess IsProcessorFeaturePresent GetStartupInfoW IsDebuggerPresent GetSystemTimeAsFileTime GetCommandLineW InitializeCriticalSectionEx GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler FreeEnvironmentStringsW GetEnvironmentStringsW RtlVirtualUnwind RtlCaptureContext QueryPerformanceCounter QueryPerformanceFrequency LeaveCriticalSection InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwindEx SetEnvironmentVariableW GetCommandLineA InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection

bcryptprimitives

ProcessPrng

advapi32

RegCreateKeyTransactedW RegOpenKeyTransactedW RegCreateKeyExW RegSetValueExW RegCloseKey RegQueryValueExW GetLengthSid CopySid LookupAccountSidW SystemFunction036 ConvertSidToStringSidW RegOpenKeyExW BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW GetAclInformation GetAce EqualSid MapGenericMask GetSecurityInfo LookupAccountNameW

oleaut32

SysFreeString SysStringLen GetErrorInfo SysAllocStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

crypt32

CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy CertVerifyTimeValidity CertGetEnhancedKeyUsage CryptProtectData CertCreateCertificateContext CertFreeCertificateContext CertEnumCertificatesInStore CryptStringToBinaryA CertDuplicateCertificateChain CertDuplicateStore CertCloseStore CertAddCertificateContextToStore CertOpenStore CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

ole32

CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

getsockopt send recv WSASend WSAGetLastError closesocket bind shutdown ioctlsocket WSASocketW connect getaddrinfo getpeername freeaddrinfo WSAStartup WSACleanup setsockopt WSAIoctl getsockname

ntdll

NtCreateNamedPipeFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtReadFile NtOpenFile NtCancelIoFileEx NtWriteFile

user32

GetSystemMetrics

secur32

AcceptSecurityContext EncryptMessage InitializeSecurityContextW DeleteSecurityContext ApplyControlToken QueryContextAttributesW FreeContextBuffer DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle

fwpuclnt

FwpmFilterDeleteByKey0 FwpmEngineClose0 FwpmTransactionAbort0 FwpmSubLayerAdd0 FwpmProviderAdd0 FwpmTransactionBegin0 FwpmEngineOpen0 FwpmTransactionCommit0 FwpmFilterAdd0

netapi32

NetLocalGroupAddMembers NetUserSetInfo NetUserAdd NetLocalGroupAdd

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_54d21dbe9ee1a7566cd5079efb56cb3c_akira_glassworm_icedid_quasar-rat_rusty-stealer

kernel32

bcryptprimitives

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

crypt32

bcrypt

ole32

ws2_32

ntdll

user32

secur32

fwpuclnt

netapi32

generic