2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer
Size 10.2MB
Sample261023-dm2f3swtbz
SHA256 125472b4e8294cf0bbbc4c75cf3cd268b3e6293210297dc956bdcbde34a14fdb
MD5 f04a13b09b6fae7eb29ad44ee9fc6dc0
SHA1 23902f9bfdeb8a069ad254037e2dd72fe327a0db
SHA512 c10549742ff353a613733d4cb1ae52f17400b3395ff8b7494d278bf23b425cd7717579116476463ce0880c614b15c8960c5367e84730c9f6afe025c5dc46f98e
SSDEEP 98304:/Bmxa+G0XpB7X6bVeIbNWQUzYjIXq39G+VvDHeNC:Fjb5xoccq39Gov6
TLSH
T111B64A12BA9B95EDC5AAC474834646739E3170DB0B26BAEB40D445393F6AEF01F3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer

File Explorer

2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer

.exe 10.2MB

2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer

IMPHASH 5dfd84b75f5705c605c184801676ad0e
SHA256 125472b4e8294cf0bbbc4c75cf3cd268b3e6293210297dc956bdcbde34a14fdb
MD5 f04a13b09b6fae7eb29ad44ee9fc6dc0
SHA1 23902f9bfdeb8a069ad254037e2dd72fe327a0db
SHA512 c10549742ff353a613733d4cb1ae52f17400b3395ff8b7494d278bf23b425cd7717579116476463ce0880c614b15c8960c5367e84730c9f6afe025c5dc46f98e
SSDEEP 98304:/Bmxa+G0XpB7X6bVeIbNWQUzYjIXq39G+VvDHeNC:Fjb5xoccq39Gov6
TLSH
T111B64A12BA9B95EDC5AAC474834646739E3170DB0B26BAEB40D445393F6AEF01F3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7214604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ketarin_cli.pdb

bcryptprimitives

ProcessPrng

kernel32

FlushFileBuffers MapViewOfFile CreateFileMappingW FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact FindNextFileW CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI CancelIo GetTimeZoneInformationForYear IsProcessorFeaturePresent GetLastError LoadLibraryW CloseHandle GetTempPathW WaitForMultipleObjects Sleep GetModuleHandleA GetModuleHandleW GetFileType TlsSetValue SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW GetModuleFileNameW HeapAlloc DeleteFileW GetFinalPathNameByHandleW GetProcAddress ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx ExitProcess FindFirstFileExW MoveFileExW CopyFileExW SetFileAttributesW lstrlenW GetCurrentThread SetThreadStackGuarantee CreateDirectoryW GetProcessHeap DuplicateHandle GetCurrentProcess CreateProcessW GetFileInformationByHandleEx GetFileInformationByHandle HeapFree HeapReAlloc GetStdHandle GetConsoleMode SetFileTime CreateEventW SetHandleInformation SetConsoleMode GetCurrentThreadId SetConsoleTextAttribute GetFullPathNameW SetLastError ReadFileEx GetConsoleScreenBufferInfo CompareStringOrdinal TlsGetValue TlsAlloc InitOnceExecuteOnce AcquireSRWLockShared ReleaseSemaphore CreateFileW AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileAttributesW InitializeSRWLock CancelIoEx SwitchToThread WriteFile GetOverlappedResult ReadFile WaitForSingleObject SetFileCompletionNotificationModes CreateThread GetQueuedCompletionStatusEx CreateSemaphoreA SetConsoleCtrlHandler FindClose PostQueuedCompletionStatus CreateIoCompletionPort SetFilePointerEx CreateToolhelp32Snapshot GetLocaleInfoEx Process32FirstW Process32NextW OpenProcess SetFileInformationByHandle WriteFileEx SleepEx WideCharToMultiByte MultiByteToWideChar GetExitCodeProcess TerminateProcess DeleteFileA IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection GetSystemTimePreciseAsFileTime GetSystemInfo QueryPerformanceFrequency QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW AddVectoredExceptionHandler TryEnterCriticalSection GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FormatMessageW GetTickCount FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetNativeSystemInfo OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

bind ioctlsocket recv connect WSAGetLastError getaddrinfo setsockopt getsockname getpeername send accept closesocket WSASend WSAStartup WSACleanup listen WSAIoctl getsockopt select shutdown freeaddrinfo WSASocketW

advapi32

RegGetValueW

user32

EnumWindows IsWindowVisible PostMessageW GetWindowThreadProcessId

shell32

ShellExecuteExW

ntdll

NtCreateFile NtOpenFile NtCreateNamedPipeFile NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile

crypt32

CertCreateCertificateChainEngine CertCloseStore CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertSetCertificateContextProperty CertFreeCertificateChain CertFreeCertificateContext CertAddEncodedCertificateToStore

vcruntime140

__current_exception __current_exception_context _CxxThrowException memcpy __CxxFrameHandler3 memset memmove memcmp strrchr strchr memchr __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow round rint __setusermatherr log

api-ms-win-crt-string-l1-1-0

strcspn strspn strlen strncmp strcmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _wassert _cexit _register_thread_local_exe_atexit_callback __p___argc _exit exit abort _initialize_onexit_table _register_onexit_function _initterm_e _initterm _crt_atexit _get_initial_narrow_environment _initialize_narrow_environment _errno terminate _configure_narrow_argv _endthreadex __p___argv _seh_filter_exe _set_app_type _beginthreadex

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fwrite fseek _setmode _fileno __acrt_iob_func fflush _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fread fclose __p__commode feof ferror fgets fopen ftell

api-ms-win-crt-heap-l1-1-0

malloc free _msize _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_f04a13b09b6fae7eb29ad44ee9fc6dc0_akira_glassworm_quasar-rat_rusty-stealer

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

advapi32

user32

shell32

ntdll

crypt32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic