2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer
Size 1.4MB
Sample261102-rn2ecswz5p
SHA256 d110a49f20562b15c501b1f2cbd4cd2072e5557f4984d9b3b66d3bf2445b6927
MD5 961b907aacb521a6fc62d23350160561
SHA1 d552f789c569d79b32a70f5e2273624fb89889c8
SHA512 ab717b57615bad12612318a35107c7d97ae1eaa6e6b49787665935204dfdb103840253dce48b75e56f05b99c53b447da35a2fc80f89d13b33d407a0ac9de8a25
SSDEEP 24576:0fTi0HvvlIVl6fSGQSdnYQn8Blu5INtqEq88zTlGPlp+Ks3Hdo0DGC7Sx:WiWvvlIVl66GuQn8SeJqX2/+Ks3Hdo0D
TLSH
T1CD659E07F65640DDC46AC13483466132FA75B8890B307AEF5AD48B763E66FE05F39B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer

File Explorer

2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer

.exe 1.4MB

2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer

IMPHASH dbd0fd616e3e832e4fce83fad64bffec
SHA256 d110a49f20562b15c501b1f2cbd4cd2072e5557f4984d9b3b66d3bf2445b6927
MD5 961b907aacb521a6fc62d23350160561
SHA1 d552f789c569d79b32a70f5e2273624fb89889c8
SHA512 ab717b57615bad12612318a35107c7d97ae1eaa6e6b49787665935204dfdb103840253dce48b75e56f05b99c53b447da35a2fc80f89d13b33d407a0ac9de8a25
SSDEEP 24576:0fTi0HvvlIVl6fSGQSdnYQn8Blu5INtqEq88zTlGPlp+Ks3Hdo0DGC7Sx:WiWvvlIVl66GuQn8SeJqX2/+Ks3Hdo0D
TLSH
T1CD659E07F65640DDC46AC13483466132FA75B8890B307AEF5AD48B763E66FE05F39B28
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

539312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gpu_encoder_helper.pdb

kernel32

VirtualProtect GetCurrentThread WaitForSingleObject GetCurrentProcess LCMapStringW LoadLibraryW GetModuleHandleW GetCurrentThreadId InitializeCriticalSectionEx GetStringTypeW CompareStringW LoadLibraryA GetCPInfo GetOEMCP GetLastError GetACP GetModuleHandleA Sleep ReleaseMutex WaitForSingleObjectEx GetCurrentProcessId CreateMutexA GetCommandLineA WriteFile RtlPcToFileHeader InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetProcAddress RtlUnwindEx HeapSize SetStdHandle SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent LoadLibraryExA FreeLibrary InitializeSListHead GetSystemTimeAsFileTime EncodePointer FormatMessageW FlsFree FlsSetValue FindFirstFileW HeapFree SetThreadErrorMode HeapAlloc GetProcessHeap GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo FlsGetValue FlsAlloc GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetStartupInfoW IsValidCodePage FindNextFileW TerminateProcess QueryPerformanceCounter GetFileAttributesW FreeEnvironmentStringsW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar ReadConsoleW QueryPerformanceFrequency ReadFile ExitProcess lstrlenW GetModuleFileNameW SetEnvironmentVariableW GetFileType CloseHandle FindClose FindFirstFileExW WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind HeapReAlloc SetFilePointerEx FlushFileBuffers CreateFileW SwitchToThread GetFileInformationByHandleEx AddVectoredExceptionHandler SetThreadStackGuarantee SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetEndOfFile

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegEnumKeyExW LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges RegQueryInfoKeyW

ole32

CoCreateFreeThreadedMarshaler CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

d3d11

D3D11CreateDevice

gdi32

D3DKMTSetProcessSchedulingPriorityClass

dxgi

CreateDXGIFactory1

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo VariantClear

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

663KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_961b907aacb521a6fc62d23350160561_akira_icedid_njrat_quasar-rat_rusty-stealer

kernel32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

d3d11

gdi32

dxgi

oleaut32

bcryptprimitives

ntdll

generic