2026-11-11_184b38add5be379e79b1ab2847d64fb5_akira_quasar-rat_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_184b38add5be379e79b1ab2847d64fb5_akira_quasar-rat_rusty-stealer
Size 8.2MB
Sample261113-t71y2sdx21
SHA256 b15a68e161689fab620324ca4c9693ea6e0e6ddaaac3f7ce5fa32c7ad0b7afff
MD5 184b38add5be379e79b1ab2847d64fb5
SHA1 5a75aa8e0665b8d0953fbff400c51b936517f004
SHA512 1a8f7be0544b0fbabbe5813fa4478660201cebd35113fe4cdcf8db9093da8d157c98be885ff1394a91e6a040eca1a175786153e7bdbe1a42b40bf6924e88ade4
SSDEEP 98304:oXbRJcsFNEk7z6fXIJoL7eJShHyRhsWm6engrL06v6NAIxD1wARVAyFKXZkRWwEg:AprL06vW6AlYwEmEo
TLSH
T187960721BB9A99ACC55AC474834A4B721A3170CB1B35BAFF44D942793F69AF41F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-11_184b38add5be379e79b1ab2847d64fb5_akira_quasar-rat_rusty-stealer

.exe 8.2MB

2026-11-11_184b38add5be379e79b1ab2847d64fb5_akira_quasar-rat_rusty-stealer

IMPHASH 1b8fd0bebc87a69a45f36153c6c31f0b
SHA256 b15a68e161689fab620324ca4c9693ea6e0e6ddaaac3f7ce5fa32c7ad0b7afff
MD5 184b38add5be379e79b1ab2847d64fb5
SHA1 5a75aa8e0665b8d0953fbff400c51b936517f004
SHA512 1a8f7be0544b0fbabbe5813fa4478660201cebd35113fe4cdcf8db9093da8d157c98be885ff1394a91e6a040eca1a175786153e7bdbe1a42b40bf6924e88ade4
SSDEEP 98304:oXbRJcsFNEk7z6fXIJoL7eJShHyRhsWm6engrL06v6NAIxD1wARVAyFKXZkRWwEg:AprL06vW6AlYwEmEo
TLSH
T187960721BB9A99ACC55AC474834A4B721A3170CB1B35BAFF44D942793F69AF41F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

98:b0:42:f6:d5:a1:04:1f:c4:d8:51:b4:47:8f:da:f2:cc:33:fb:b8:c5:1f:71:60:ce:66:1a:5e:38:fa:96:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Posit Software\, PBC,O=Posit Software\, PBC,L=Boston,ST=Massachusetts,C=US

Chains

Oct 1, 2026

CN=Posit Software\, PBC,O=Posit Software\, PBC,L=Boston,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Posit Software\, PBC,O=Posit Software\, PBC,L=Boston,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Posit Software\, PBC,O=Posit Software\, PBC,L=Boston,ST=Massachusetts,C=US

Serial Number

06:bc:b8:2b:1b:84:23:e3:35:02:5d:ec:8c:82:02:34

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 17, 2026 - Jul 16, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

5481344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

air.pdb

kernel32

GetStdHandle GetModuleHandleA GetProcAddress SystemTimeToTzSpecificLocalTime SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind WideCharToMultiByte lstrlenW LoadLibraryA GetProcessHeap HeapFree HeapReAlloc SetFilePointerEx SetFileInformationByHandle GetLastError SetConsoleMode WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetConsoleMode CreateFileW WaitForSingleObjectEx GetCurrentProcessId GetFinalPathNameByHandleW GetFileInformationByHandleEx CreateMutexA FindFirstFileExW FindClose GetFileType GetModuleHandleW FormatMessageW GetQueuedCompletionStatusEx GetFullPathNameW GetModuleFileNameW ExitProcess GetFileInformationByHandle GetConsoleScreenBufferInfo CreateIoCompletionPort HeapAlloc ReadConsoleW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread GetSystemTimePreciseAsFileTime GetCurrentThreadId GetSystemInfo TerminateProcess FindNextFileW PostQueuedCompletionStatus ReleaseMutex SetConsoleTextAttribute IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent SwitchToThread GetCurrentProcess UnhandledExceptionFilter CloseHandle SetFileTime Sleep SetUnhandledExceptionFilter

ntdll

RtlNtStatusToDosError NtWriteFile NtDeviceIoControlFile NtCancelIoFileEx NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 memmove memcmp __current_exception memcpy memset __current_exception_context

api-ms-win-crt-math-l1-1-0

pow _fdopen __setusermatherr

api-ms-win-crt-string-l1-1-0

iswctype strlen wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc free malloc calloc

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func fclose _set_fmode fputc fputs __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit _register_onexit_function _crt_atexit _initterm abort _wassert _cexit exit __p___argv __p___argc _get_initial_narrow_environment _seh_filter_exe _set_app_type _exit _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _initterm_e

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_184b38add5be379e79b1ab2847d64fb5_akira_quasar-rat_rusty-stealer

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

shell32

combase

bcryptprimitives

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic