2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz
Size 38.6MB
Sample260808-gdspcsvsbs
SHA256 8331ab3d659d3e83866c2fc3b768f9db79eecd65169bdbb62493ced35ad52b23
MD5 e1b01cd7db2390dabd93cbfd861d3480
SHA1 371d6993075c8a4675ffbc472cdde6df3505af13
SHA512 3bc69379a8ded909debd8f337e5b1ee3a99460a6dddd80994d6b0575592899c0cb6f0c92b770f066038910613ed8246e9c0dd2b516ff7383b105a8c56a6c695b
SSDEEP 196608:70QFq6JClZmE9H1yf8935VkCrkS1XVtXf/HA4GZwEVIITNa5SOZHek+rn:oQFilZ71Xr4wMNa0OZHan
TLSH
T1C297F821BA6A596DD19AC874834A47735E3030DB1A35B9FF54C982383F6DAF42B3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz

File Explorer

2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz

.exe 38.6MB

2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz

IMPHASH 4f694c525ea88e7efc3fc06f3bbdef5e
SHA256 8331ab3d659d3e83866c2fc3b768f9db79eecd65169bdbb62493ced35ad52b23
MD5 e1b01cd7db2390dabd93cbfd861d3480
SHA1 371d6993075c8a4675ffbc472cdde6df3505af13
SHA512 3bc69379a8ded909debd8f337e5b1ee3a99460a6dddd80994d6b0575592899c0cb6f0c92b770f066038910613ed8246e9c0dd2b516ff7383b105a8c56a6c695b
SSDEEP 196608:70QFq6JClZmE9H1yf8935VkCrkS1XVtXf/HA4GZwEVIITNa5SOZHek+rn:oQFilZ71Xr4wMNa0OZHan
TLSH
T1C297F821BA6A596DD19AC874834A47735E3030DB1A35B9FF54C982383F6DAF42B3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26006016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fbuild_daemon.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AreFileApisANSI AssignProcessToJobObject CancelIo CancelIoEx CancelSynchronousIo ClearCommBreak ClearCommError CloseHandle CompareStringOrdinal ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateSymbolicLinkW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection EscapeCommFunction ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommModemStatus GetCommState GetCommandLineW GetCompressedFileSizeW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetVolumeInformationByHandleW GetVolumePathNameW GetWindowsDirectoryW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus PurgeComm QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCommBreak SetCommState SetCommTimeouts SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile WriteFileEx lstrlenW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown socket

setupapi

CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Parent SetupDiClassGuidsFromNameW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey

advapi32

AddAce AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW CopySid FreeSid GetAce GetAclInformation GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthorityCount InitializeAcl InitializeSecurityDescriptor IsValidSid LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SetNamedSecurityInfoW SetSecurityDescriptorControl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorSacl SystemFunction036

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlNtStatusToDosError

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_terminate memchr memcmp memcpy memmove memset strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf _set_fmode fclose fputc fputs fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _wassert abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen fmod log pow

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

iswctype strcmp strcspn strlen strncmp strspn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

25.1MB

Virtual Size

25.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.1MB

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

82KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_e1b01cd7db2390dabd93cbfd861d3480_akira_glassworm_quasar-rat_rusty-stealer_zxxz

kernel32

ws2_32

setupapi

advapi32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

pdh

powrprof

bcrypt

shell32

combase

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic