2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer
Size 1.3MB
Sample260809-31lefsfp3v
SHA256 25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4
MD5 463ebdef459ba406e002bd69e7cc5fb2
SHA1 45002acbda9278e95b424fe7a0d310203f334f91
SHA512 34661626caf942e048f5d881338737d21922ec62419071360dcbffe6c89486a9b7a2a49eb68458f5d34ae4dd3863666543032ea306db2016bbedf135d73d17a9
SSDEEP 24576:UdKx4n0yqC6BsrAHtoAfYLH8AcevDN0FImbwQuq3Wia7gD:wKIhVe2AQgAT76sQuE
TLSH
T1C055B013B24A91ECD96EC07C471651727632B88D47307AEB22956F383E6BDC22B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer

File Explorer

2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer

.exe 1.3MB

2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer

IMPHASH a2b3d7d2a4c57dcd6fd9ce60d9bab3c9
SHA256 25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4
MD5 463ebdef459ba406e002bd69e7cc5fb2
SHA1 45002acbda9278e95b424fe7a0d310203f334f91
SHA512 34661626caf942e048f5d881338737d21922ec62419071360dcbffe6c89486a9b7a2a49eb68458f5d34ae4dd3863666543032ea306db2016bbedf135d73d17a9
SSDEEP 24576:UdKx4n0yqC6BsrAHtoAfYLH8AcevDN0FImbwQuq3Wia7gD:wKIhVe2AQgAT76sQuE
TLSH
T1C055B013B24A91ECD96EC07C471651727632B88D47307AEB22956F383E6BDC22B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar ReadConsoleW ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx __C_specific_handler lstrlenW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

shell32

ole32

generic