2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound
Size 2.6MB
Sample260926-wt9edazxev
SHA256 c0c2ff1a7ca5943ccd6304591f00332ddd7e594feea5d88366960d07e78feb47
MD5 96953473f249b5e72fbcb64d430b86f8
SHA1 d125f4afc98232c82e71a466acc099abb7f798b5
SHA512 404de82d844eb45d5738ba20562eacc420377cf8fd034e06a295dddb46b2d5d463ad6c0b085e9b75839474913988ce7f26b52d303f4e8b7b4a1baa55c0ad7595
SSDEEP 49152:5CBlKQN/LV9lGokD7VMEE7YxTKf2hTugjuKPHBokDHIU6i:5w0Y/Tl/ebJ5o+
TLSH
T124C56C43F56680E8C05EC1B8835A9633FA36BC8D093076FB27D49B212E66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound

File Explorer

2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound

.exe 2.6MB

2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound

IMPHASH 603c761e614e99c83c4ccb370d8dae69
SHA256 c0c2ff1a7ca5943ccd6304591f00332ddd7e594feea5d88366960d07e78feb47
MD5 96953473f249b5e72fbcb64d430b86f8
SHA1 d125f4afc98232c82e71a466acc099abb7f798b5
SHA512 404de82d844eb45d5738ba20562eacc420377cf8fd034e06a295dddb46b2d5d463ad6c0b085e9b75839474913988ce7f26b52d303f4e8b7b4a1baa55c0ad7595
SSDEEP 49152:5CBlKQN/LV9lGokD7VMEE7YxTKf2hTugjuKPHBokDHIU6i:5w0Y/Tl/ebJ5o+
TLSH
T124C56C43F56680E8C05EC1B8835A9633FA36BC8D093076FB27D49B212E66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter AssignProcessToJobObject AttachConsole CheckRemoteDebuggerPresent CloseHandle CreateDirectoryW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateJobObjectW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GetTimeZoneInformationForYear GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsDebuggerPresent LoadLibraryExA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus Process32FirstW Process32NextW RtlLookupFunctionEntry SetCurrentDirectoryW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW lstrlenW

ntdll

NtCancelIoFileEx NtClose NtCreateFile NtDeviceIoControlFile NtMapViewOfSection NtOpenFile NtOpenSection NtQueryInformationProcess NtReadFile NtUnmapViewOfSection NtWriteFile RtlNtStatusToDosError

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

oleaut32

GetErrorInfo SysFreeString SysStringLen

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt shutdown

advapi32

GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity

bcryptprimitives

ProcessPrng

netapi32

NetApiBufferFree NetSessionEnum NetWkstaUserEnum

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

EnumDisplayMonitors GetDC GetMonitorInfoW GetSystemMetrics ReleaseDC SetProcessDpiAwarenessContext

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

GetAdaptersAddresses

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fputc setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr log2 pow

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

memset strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

mbrtowc wcrtomb

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

665KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_96953473f249b5e72fbcb64d430b86f8_akira_glassworm_quasar-rat_rusty-stealer_sharphound

kernel32

ntdll

secur32

oleaut32

ws2_32

advapi32

bcrypt

crypt32

bcryptprimitives

netapi32

api-ms-win-core-synch-l1-2-0

user32

gdi32

iphlpapi

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic