17160e17284325080898878a27c52d38ce68212185f9a12242f8b725ab2eabd7

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
Size 45.0MB
Sample260415-tdrtaae161
SHA256 17160e17284325080898878a27c52d38ce68212185f9a12242f8b725ab2eabd7
MD5 86e1cdc3a67ea7dadb5701dbbe073af4
SHA1 2c2591abdd61a924346fade14966ce78bd6dd43c
SHA512 ab346163a3f5520beb476a8ae747de141907cc68088bdbfbf12ff85da163eee129bc2d807a9889a419000fb7fdf0513607e96384de4bbecda8411647093c96b5
SSDEEP 49152:+GnI4MmA8gPyXHpoHHi41ckSAHIALFsyMGJZT2TufPzKOHmH8OY+f2ySmwEwO2iN:VvQvHxTJF3zxOfbSmww2iW8
TLSH
T142A795C647495822C8E3047A1C1E0389E6FD319B5571EA3D69D4F18CBE9F2E617B8BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Enumerates VirtualBox DLL files 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VirtualBox executables on disk 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\VBoxControl.exe	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\VBoxService.exe	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VMWare drivers on disk 2 TTPs 3 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3232	powershell.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
512	ipconfig.exe
3024	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3228	systeminfo.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
1788	taskkill.exe
912	taskkill.exe
1916	taskkill.exe
1568	taskkill.exe
464	taskkill.exe
1872	taskkill.exe
3476	taskkill.exe
5036	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3232	powershell.exe
3232	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	powershell.exe
Token: 0	3232	powershell.exe
Token: SeImpersonatePrivilege	3232	powershell.exe
Token: SeBackupPrivilege	3232	powershell.exe
Token: SeRestorePrivilege	3232	powershell.exe
Token: SeTakeOwnershipPrivilege	3232	powershell.exe
Token: SeSecurityPrivilege	3232	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3232	powershell.exe
Token: SeTcbPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4316	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	85
PID 4316 wrote to memory of 4120	4316	cmd.exe	87
PID 5048 wrote to memory of 3232	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	88
PID 3232 wrote to memory of 1632	3232	powershell.exe	90
PID 1632 wrote to memory of 3728	1632	csc.exe	91
PID 5048 wrote to memory of 1732	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	92
PID 1732 wrote to memory of 3228	1732	cmd.exe	94
PID 5048 wrote to memory of 2376	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	97
PID 2376 wrote to memory of 1288	2376	cmd.exe	99
PID 5048 wrote to memory of 1568	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	100
PID 5048 wrote to memory of 464	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	102
PID 5048 wrote to memory of 1872	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	104
PID 5048 wrote to memory of 3476	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	106
PID 5048 wrote to memory of 5036	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	108
PID 5048 wrote to memory of 1788	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	110
PID 5048 wrote to memory of 912	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	112
PID 5048 wrote to memory of 1916	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	114
PID 5048 wrote to memory of 1892	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	116
PID 1892 wrote to memory of 512	1892	cmd.exe	118
PID 5048 wrote to memory of 2600	5048	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	119
PID 2600 wrote to memory of 3024	2600	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /C chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\priv_1776269961114.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yxj45hfe\yxj45hfe.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5270.tmp" "c:\Users\Admin\AppData\Local\Temp\yxj45hfe\CSC5F91F56EA27E42B7ABDA2498D5774FBB.TMP"
      4⤵
      PID:3728
- C:\Windows\system32\cmd.exe
  "cmd" /C systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3228
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil volume diskfree C:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\fsutil.exe
    fsutil volume diskfree C:
    3⤵
    PID:1288
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM librewolf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\system32\cmd.exe
  "cmd" /C "ipconfig /all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:512
- C:\Windows\system32\cmd.exe
  "cmd" /C "ipconfig /displaydns"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\ipconfig.exe
    ipconfig /displaydns
    3⤵
    - Gathers network information
    PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5270.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5270.tmp
Size 1KB
SHA256 45a671ae365b589c0e0283c9177222c308f5d12ed73fcd60077d70272c10fc83
MD5 38a0884647641e67140893d5530590c2
SHA1 13e28c694f24a3e7d6e2ede2082c664796832f9e
SHA512 80969e3ae489ebb89f05c25fe0d657841bce80aea746f98c1052643da98a8c5cf5770e468fc943c81af42cf1613df659e12a2edc2e6c966462472fc60e475bc8
TLSH
T19C21CE0697E94B1FF07747316AF6132BA274FDA5EFB2A35B8541422C1C81114EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yoe2x4xa.pb3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yoe2x4xa.pb3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

priv_1776269961114.ps1

Path C:\Users\Admin\AppData\Local\Temp\priv_1776269961114.ps1
Size 1KB
SHA256 d7dafbf9c9be01522a3a39b395c07cf4f7ef4bc1c538f98fc1e16f4d7d6e22a7
MD5 73968115f41a4b309566a31f3d6a72dd
SHA1 9c66cf144998fd3a7d3f7385b8a51f07739f6575
SHA512 2b484c9af761649ed24855dac11ad0ff558c9192b85e528b188c3f847ad0380b8e529e171ee69bbce53e5eda7bee087ae5981340355c8feb01f5e9a7184fed0c
TLSH
T16E31108963FA51B1C463A5BDD9D9F58BBD23003616FFEE11B27D53624F821268031626
MD5 SHA1 SHA512 TLSH

Submit Download

yxj45hfe.dll

Path C:\Users\Admin\AppData\Local\Temp\yxj45hfe\yxj45hfe.dll
Size 4KB
SHA256 7b12b58a1ac1852438e52fe603dcf2b25f2290c5c2a361f0cbbb151fb08a0d07
MD5 f8a7eba2da0eb0938ab3a80bdfce48e1
SHA1 3a3d6ba35e66d0ac0840f427a57000072559e713
SHA512 5b25336a3e7dcaee569a1df7039bfd7309b924650830aeb18a7287ce28ed0d583d7d5d399771d0b6216e8bc171c6417d184a9168a7d3d0178bd0b2aa0d2dcc2e
TLSH
T1A181FD03D7E84627E4A70778AEF3071262B0F8109F73972F58D453696C916641E22BB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5F91F56EA27E42B7ABDA2498D5774FBB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yxj45hfe\CSC5F91F56EA27E42B7ABDA2498D5774FBB.TMP
Size 652B
SHA256 9d8987e239aea03abca4e1c2bf54df871336a3139bcb9679ea7eaff9624ee3d4
MD5 66db21c9ad9afa7070b182fb69046286
SHA1 14b8388bc0bab5f9192293721ea0d6339b5535f6
SHA512 3c9b7706c472632739433c58abe14f47ff2b16eeabc3870bfee76368eb68fb3e3e9d10537c83eb46031c126c8c463dad1b70fe3d307c8d8baa57fc06a13994e0
TLSH
T1DEF0890A73F8020EF0F34B70BDF543639168BC65DE3253ED1881031D1C645108562F71
MD5 SHA1 SHA512 TLSH

Submit Download

yxj45hfe.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yxj45hfe\yxj45hfe.0.cs
Size 1KB
SHA256 54b820cfb35f02d4184f54185661c6674d8c784b47cdad1af601c9a3f4a6ee39
MD5 def92637cb211496a23377ca8b748bc2
SHA1 c2ce35f5d6c00a9a0e25e73b6ede71edd33a1964
SHA512 c7135b8843a80d94539034d570978096297d9331d70a65ced9818fe9abac04b02f27b78fcf9faf7edcb23d958fd13d7dac84711590c9b756ccd7ac2cec7d2413
TLSH
T17D21DF0863E692704453B95DDAC5F5CBB923013625FFAD21B17C53728F46126C43562A
MD5 SHA1 SHA512 TLSH

Submit Download

yxj45hfe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yxj45hfe\yxj45hfe.cmdline
Size 369B
SHA256 cbc456788749ca6b4e4f73b4732fe8612987dcdd918c1c77d1bf63b46ef4f6e5
MD5 3762efe44da8ba24d25cbc3f3f034d3b
SHA1 ea7ef8d291a7e73023bd4f9cc7dd9a1544f7e2cc
SHA512 c6c793e9bccf4ee6d13b8402ef839be1da773efe167be4c5a49a59e4559b31c6f694b371729ce4021b627243ec422c868e28cfdd4d03ff72c75e09e99ccb67bc
TLSH
T16AE0C62B4B5AC27D01ED100F337EC4ECC2B20F8329903FA4A6E0840DE4270003BD278A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1632-25-0x0000018CD2500000-0x0000018CD250C000-memory.dmp

Download

memory/1632-24-0x0000018CD2300000-0x0000018CD24A1000-memory.dmp

Download

memory/3232-1-0x00000260C5060000-0x00000260C5070000-memory.dmp

Download

memory/3232-3-0x00000260C51E0000-0x00000260C5202000-memory.dmp

Download

memory/3232-2-0x00000260C5060000-0x00000260C5070000-memory.dmp

Download

memory/3232-27-0x00000260C5050000-0x00000260C5058000-memory.dmp

Download

memory/3232-30-0x00000260AB070000-0x00000260AB211000-memory.dmp

Download

memory/3232-31-0x00000260ACAA0000-0x00000260ACAAC000-memory.dmp

Download

memory/3728-21-0x000002201A430000-0x000002201A43C000-memory.dmp

Download

memory/5048-32-0x00007FF6D5AF0000-0x00007FF6D5E8A000-memory.dmp

Download

memory/5048-40-0x00007FF6D5AF0000-0x00007FF6D5E8A000-memory.dmp

Download