2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer
Size 7.3MB
Sample260809-xhcrpsca25
SHA256 d2138c2fc3a8c34c376b90e4cf040adcd0f885978c650602581ae6d46a5c58a2
MD5 0c1489819cf980dc07b1731329becf7b
SHA1 7df9e447365faebb6adc6e56556a96dbe9576668
SHA512 f9cff3b3d6f27a6aeb91853d861e987e05288152a83b27cff7375dedec99d47d4d06c80233632eb448e5d79181a72ea9fd538b54a9e7bfc920253b19df810b3d
SSDEEP 98304:y5o0rdQmNaX/6KyBP2Cduj13sFhiE6tPmMrn+6:7ghNU9YS
TLSH
T199763912BA5A54ACC05AC474834B4A326A7170CB1B35B9FF44D496793FAAEF41F3C728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer

.exe 7.3MB

2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH 258ef8f58b8df48307575b0954d27c0d
SHA256 d2138c2fc3a8c34c376b90e4cf040adcd0f885978c650602581ae6d46a5c58a2
MD5 0c1489819cf980dc07b1731329becf7b
SHA1 7df9e447365faebb6adc6e56556a96dbe9576668
SHA512 f9cff3b3d6f27a6aeb91853d861e987e05288152a83b27cff7375dedec99d47d4d06c80233632eb448e5d79181a72ea9fd538b54a9e7bfc920253b19df810b3d
SSDEEP 98304:y5o0rdQmNaX/6KyBP2Cduj13sFhiE6tPmMrn+6:7ghNU9YS
TLSH
T199763912BA5A54ACC05AC474834B4A326A7170CB1B35B9FF44D496793FAAEF41F3C728
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5729724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tracedeck.pdb

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawIconEx EnableWindow FillRect GetClassNameW GetClientRect GetCursorInfo GetDC GetDpiForSystem GetDpiForWindow GetForegroundWindow GetIconInfo GetMessageW GetSysColorBrush GetSystemMetrics GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId LoadIconW LoadImageW MessageBoxW PeekMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassW ReleaseDC SendMessageW SetProcessDpiAwarenessContext SetTimer SetWinEventHook SetWindowPos SetWindowTextW ShowWindow TranslateMessage UnhookWinEvent

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetWindowsDirectoryW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEndOfFile SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateFontW DeleteDC DeleteObject GetStockObject SelectObject SetBkMode

comdlg32

GetOpenFileNameW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

GetErrorInfo SysFreeString SysStringLen VariantClear

ntdll

NtCreateNamedPipeFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

userenv

GetUserProfileDirectoryW

bcryptprimitives

ProcessPrng

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

advapi32

CloseTrace ControlTraceW ConvertSidToStringSidW EnableTraceEx2 GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupAccountSidW OpenProcessToken OpenTraceW ProcessTrace StartTraceW StopTraceW SystemFunction036

wtsapi32

WTSQueryUserToken

d3d11

D3D11CreateDevice

mfplat

MFCopyImage MFCreateAttributes MFCreateMediaType MFCreateMemoryBuffer MFCreateSample MFShutdown MFStartup MFTEnumEx

mfreadwrite

MFCreateSinkWriterFromURL

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity

wevtapi

EvtClose EvtRender EvtSubscribe

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

tdh

TdhGetEventInformation TdhGetProperty TdhGetPropertySize

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context memchr memcmp memcpy memmove memset strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass log round roundf

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strcspn strlen strncmp strspn wcslen

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_0c1489819cf980dc07b1731329becf7b_akira_glassworm_quasar-rat_rusty-stealer

user32

kernel32

ws2_32

gdi32

comdlg32

ole32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

userenv

bcryptprimitives

shell32

combase

advapi32

wtsapi32

d3d11

mfplat

mfreadwrite

bcrypt

crypt32

wevtapi

iphlpapi

tdh

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic