2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer
Size 86.8MB
Sample260407-eke1qsf13p
SHA256 bbdfa2ddefb09f82e5c69f48d274228ef77ad84f61ae78b500ba71d525afaaff
MD5 9ddfb7cf08a3ac6848d7b8328a22d251
SHA1 080eac6d972c2582a411d34bd207bc43b086cb40
SHA512 dd5ea59fd0578fbd6fe75f1199b0380166d8069552493b19e7d6481a48703381b5bb5ee0760c6c042df0218d5274ba1ee559e689e477c1a897659a0353f649a4
SSDEEP 1572864:0EyQbuBJqUeSLAstlQd8eo0OKMhBGUhuGn0fXt8wrmjWVhEZWxQehNExbF:Dy8u6Y3tlQCoOLhEUhv0fXtwqhN+ePAF
TLSH
T1F3182202BA4A2A69C05AC8B0D2474A934F3130DB123BE5BF51E941743F9E7F49B3E795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer

File Explorer

2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer

.exe 86.8MB

2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer

IMPHASH da628c07837ce56c28b516d7feb9aea9
SHA256 bbdfa2ddefb09f82e5c69f48d274228ef77ad84f61ae78b500ba71d525afaaff
MD5 9ddfb7cf08a3ac6848d7b8328a22d251
SHA1 080eac6d972c2582a411d34bd207bc43b086cb40
SHA512 dd5ea59fd0578fbd6fe75f1199b0380166d8069552493b19e7d6481a48703381b5bb5ee0760c6c042df0218d5274ba1ee559e689e477c1a897659a0353f649a4
SSDEEP 1572864:0EyQbuBJqUeSLAstlQd8eo0OKMhBGUhuGn0fXt8wrmjWVhEZWxQehNExbF:Dy8u6Y3tlQCoOLhEUhv0fXtwqhN+ePAF
TLSH
T1F3182202BA4A2A69C05AC8B0D2474A934F3130DB123BE5BF51E941743F9E7F49B3E795
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6322464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SoftEngine.pdb

kernel32

SetFilePointerEx FindNextFileW SetHandleInformation CreateDirectoryW GetProcessHeap GetModuleHandleW FindFirstFileExW Sleep GetModuleHandleA CloseHandle GetFileInformationByHandle GetModuleFileNameW HeapFree HeapAlloc GetSystemDirectoryW GetWindowsDirectoryW FormatMessageW GetFileAttributesW SetFileTime DeleteFileW SetFileInformationByHandle SetLastError ReadFileEx GetSystemInfo GetPhysicallyInstalledSystemMemory WriteFileEx GetOverlappedResult CancelIo GetDiskFreeSpaceExW ReadFile PostQueuedCompletionStatus GetTickCount64 GetConsoleWindow GetStdHandle GlobalSize GlobalAlloc GlobalFree FreeConsole SetFileCompletionNotificationModes CreateIoCompletionPort GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime GetQueuedCompletionStatusEx GetFinalPathNameByHandleW GlobalLock GlobalUnlock GetProcAddress GetLastError FindClose UnmapViewOfFile VirtualProtect DuplicateHandle MapViewOfFile CreateFileMappingW HeapReAlloc FreeLibrary SetThreadErrorMode FlushFileBuffers HeapSize GetFileType SetStdHandle WriteFile GetConsoleMode GetConsoleOutputCP CreateFileW GetSystemTimeAsFileTime GetModuleHandleExW WriteConsoleW LoadLibraryA GetTempPathW LoadLibraryExW GetFullPathNameW LoadLibraryExA SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW LeaveCriticalSection RemoveVectoredExceptionHandler CreateEventA QueryPerformanceCounter ExitProcess CreateEventW GetExitCodeProcess WaitForMultipleObjects SleepEx CreateThread FreeEnvironmentStringsW GetEnvironmentStringsW CreateProcessW CompareStringOrdinal GetCommandLineW QueryPerformanceFrequency GetEnvironmentVariableW ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar WaitForSingleObject GetUserPreferredUILanguages WideCharToMultiByte GetCurrentThread SetThreadStackGuarantee SwitchToThread AddVectoredExceptionHandler SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot GetCurrentProcess GetCurrentThreadId

advapi32

SystemFunction036 RegCreateKeyExW RegCloseKey RegSetValueExW RegOpenKeyExW RegQueryValueExW RegEnumKeyExW RevertToSelf ImpersonateAnonymousToken GetTokenInformation OpenProcessToken

oleaut32

SysFreeString GetErrorInfo SysStringLen

ntdll

NtDeviceIoControlFile NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile NtCreateFile RtlNtStatusToDosError NtCancelIoFileEx

ws2_32

ioctlsocket closesocket connect getsockopt recv WSAIoctl bind shutdown getsockname WSAGetLastError getaddrinfo freeaddrinfo WSAStartup WSASend WSACleanup send setsockopt WSASocketW getpeername

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateChain CertOpenStore CertDuplicateCertificateChain CertCloseStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateStore CertGetCertificateChain

secur32

FreeContextBuffer AcceptSecurityContext EncryptMessage AcquireCredentialsHandleA ApplyControlToken DecryptMessage FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW InitializeSecurityContextW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW VkKeyScanW GetCursorPos SendInput CloseClipboard ShowWindow DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW GetSystemMetrics MessageBoxW GetWindowLongPtrW RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EmptyClipboard GetWindowLongW GetMenu AdjustWindowRectEx SendMessageW SetWindowLongW DestroyCursor GetKeyboardLayout MapVirtualKeyExW GetKeyState GetKeyboardState TrackMouseEvent ScreenToClient GetTouchInputInfo GetWindowPlacement MonitorFromRect CloseTouchInputHandle DefWindowProcW LoadCursorW SetCursor MonitorFromWindow ReleaseCapture GetMonitorInfoW GetWindowRect SetCapture GetClipCursor ClipCursor ShowCursor IsIconic ChangeDisplaySettingsExW SetWindowPlacement GetRawInputData SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware SetForegroundWindow SetClipboardData SystemParametersInfoA EnableMenuItem RegisterWindowMessageA ToUnicodeEx IsWindowVisible ClientToScreen GetSystemMenu SetWindowPos InvalidateRgn GetActiveWindow GetForegroundWindow PostMessageW

shell32

DragQueryFileW ShellExecuteW DragFinish

gdi32

SelectObject DeleteDC CreateCompatibleDC DeleteObject CreateDIBSection ChoosePixelFormat GetPixelFormat DescribePixelFormat CreateRectRgn GetDeviceCaps SwapBuffers SetPixelFormat BitBlt

opengl32

wglGetProcAddress wglCreateContext wglGetCurrentContext wglMakeCurrent wglDeleteContext

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance RevokeDragDrop RegisterDragDrop OleInitialize CoInitializeEx CoUninitialize

uxtheme

SetWindowTheme

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80.1MB

Virtual Size

80.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

320KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer

kernel32

advapi32

oleaut32

ntdll

ws2_32

bcrypt

crypt32

secur32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

shell32

gdi32

opengl32

d3dcompiler_47

ole32

uxtheme

imm32

dwmapi

generic