2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer
Size 3.4MB
Sample260903-mpymmsvela
SHA256 40a48238b95da4b9da10fba00f71aa5b29bc11eba44e2beb57d9503793673dd7
MD5 6751d0af7845c3cfee570d98eb94c4e4
SHA1 4210a3a3fb7caf50732976277d2d5fea6e9c3646
SHA512 aa7f491b0b81ff9a6d679a34b9bca5ea5ca302f40126d399ca93788e40915623e1148cf767051c9c8427cf0f0aa73cb060c1db911ce44a0e73c0071326de3d6c
SSDEEP 49152:lKnypJmzZaqmB++p0FAgf9UACI2DWWG1JbOMN/U7uX:3dpKHRnN8S
TLSH
T121F519217B4999AEC15AC074C3878A722A7170CB0B34B9FF45D496783F6AAF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer

.exe 3.4MB

2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH ac7c36d8188baff91df6c4c101c5585a
SHA256 40a48238b95da4b9da10fba00f71aa5b29bc11eba44e2beb57d9503793673dd7
MD5 6751d0af7845c3cfee570d98eb94c4e4
SHA1 4210a3a3fb7caf50732976277d2d5fea6e9c3646
SHA512 aa7f491b0b81ff9a6d679a34b9bca5ea5ca302f40126d399ca93788e40915623e1148cf767051c9c8427cf0f0aa73cb060c1db911ce44a0e73c0071326de3d6c
SSDEEP 49152:lKnypJmzZaqmB++p0FAgf9UACI2DWWG1JbOMN/U7uX:3dpKHRnN8S
TLSH
T121F519217B4999AEC15AC074C3878A722A7170CB0B34B9FF45D496783F6AAF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2263248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

test_rust.pdb

ws2_32

shutdown WSACleanup WSASocketW WSAIoctl connect ioctlsocket getsockopt getpeername getsockname send WSASend recv WSAStartup freeaddrinfo getaddrinfo socket WSAGetLastError setsockopt bind closesocket

secur32

LsaGetLogonSessionData EncryptMessage LsaFreeReturnBuffer AcceptSecurityContext InitializeSecurityContextW LsaEnumerateLogonSessions FreeContextBuffer DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleA DecryptMessage ApplyControlToken

crypt32

CertFreeCertificateChain CertDuplicateCertificateChain CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertOpenStore CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW LookupAccountSidW IsValidSid GetLengthSid CopySid GetTokenInformation OpenProcessToken

kernel32

MultiByteToWideChar WriteConsoleW LocalFree Sleep SetFileCompletionNotificationModes CreateThread GetStdHandle GetConsoleMode GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetSystemInfo CreateIoCompletionPort GetCurrentProcessId GetDiskFreeSpaceExW GetTickCount64 GlobalMemoryStatusEx K32GetPerformanceInfo VirtualQueryEx FindFirstVolumeW FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW GetCurrentProcess CloseHandle SetHandleInformation GetProcAddress ReadConsoleW QueryPerformanceFrequency GetModuleHandleW GetModuleHandleA GetSystemTimeAsFileTime IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetDriveTypeW GetVolumeInformationW CreateFileW DeviceIoControl UnhandledExceptionFilter ExitProcess GetProcessTimes GetComputerNameExW GetProcessHeap HeapFree GetSystemTimes GetProcessIoCounters GetConsoleOutputCP SetUnhandledExceptionFilter HeapAlloc GetCurrentThreadId ReadProcessMemory FindNextFileW OpenProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryExA FreeLibrary GetLastError WaitForSingleObject FormatMessageW QueryPerformanceCounter HeapReAlloc GetSystemTimePreciseAsFileTime lstrlenW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetFileInformationByHandle GetFullPathNameW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetFileInformationByHandleEx SwitchToThread GetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileExW FindClose GetFileType

ntdll

NtWriteFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlGetVersion

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

iphlpapi

FreeMibTable GetIfTable2 GetAdaptersAddresses

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhGetFormattedCounterValue PdhOpenQueryA

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree NetUserGetInfo NetUserEnum NetUserGetLocalGroups

oleaut32

SysStringLen GetErrorInfo SysFreeString

psapi

GetProcessMemoryInfo GetModuleFileNameExW

shell32

CommandLineToArgvW

vcruntime140

memmove __C_specific_handler memcmp memcpy __CxxFrameHandler3 _CxxThrowException memset __current_exception_context __current_exception

api-ms-win-crt-math-l1-1-0

__setusermatherr pow round

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initterm _exit exit _initterm_e

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_6751d0af7845c3cfee570d98eb94c4e4_akira_glassworm_quasar-rat_rusty-stealer

ws2_32

secur32

crypt32

advapi32

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

iphlpapi

pdh

powrprof

netapi32

oleaut32

psapi

shell32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic