17160e17284325080898878a27c52d38ce68212185f9a12242f8b725ab2eabd7

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
Size 45.0MB
Sample260415-tdrtaae161
SHA256 17160e17284325080898878a27c52d38ce68212185f9a12242f8b725ab2eabd7
MD5 86e1cdc3a67ea7dadb5701dbbe073af4
SHA1 2c2591abdd61a924346fade14966ce78bd6dd43c
SHA512 ab346163a3f5520beb476a8ae747de141907cc68088bdbfbf12ff85da163eee129bc2d807a9889a419000fb7fdf0513607e96384de4bbecda8411647093c96b5
SSDEEP 49152:+GnI4MmA8gPyXHpoHHi41ckSAHIALFsyMGJZT2TufPzKOHmH8OY+f2ySmwEwO2iN:VvQvHxTJF3zxOfbSmww2iW8
TLSH
T142A795C647495822C8E3047A1C1E0389E6FD319B5571EA3D69D4F18CBE9F2E617B8BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Enumerates VirtualBox DLL files 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VirtualBox executables on disk 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\VBoxService.exe	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\VBoxControl.exe	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Looks for VMWare drivers on disk 2 TTPs 3 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3908	powershell.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2100	ipconfig.exe
4100	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2088	systeminfo.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
2216	taskkill.exe
2184	taskkill.exe
4724	taskkill.exe
4388	taskkill.exe
1836	taskkill.exe
1896	taskkill.exe
3048	taskkill.exe
428	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	powershell.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	powershell.exe
Token: 0	3908	powershell.exe
Token: SeImpersonatePrivilege	3908	powershell.exe
Token: SeBackupPrivilege	3908	powershell.exe
Token: SeRestorePrivilege	3908	powershell.exe
Token: SeTakeOwnershipPrivilege	3908	powershell.exe
Token: SeSecurityPrivilege	3908	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3908	powershell.exe
Token: SeTcbPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3252	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	80
PID 3252 wrote to memory of 3924	3252	cmd.exe	82
PID 3088 wrote to memory of 3908	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	83
PID 3908 wrote to memory of 4304	3908	powershell.exe	85
PID 4304 wrote to memory of 1496	4304	csc.exe	86
PID 3088 wrote to memory of 4888	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	87
PID 4888 wrote to memory of 2088	4888	cmd.exe	89
PID 3088 wrote to memory of 2920	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	92
PID 2920 wrote to memory of 2080	2920	cmd.exe	94
PID 3088 wrote to memory of 2184	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	95
PID 3088 wrote to memory of 4724	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	97
PID 3088 wrote to memory of 4388	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	99
PID 3088 wrote to memory of 1836	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	101
PID 3088 wrote to memory of 1896	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	103
PID 3088 wrote to memory of 3048	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	105
PID 3088 wrote to memory of 428	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	107
PID 3088 wrote to memory of 2216	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	109
PID 3088 wrote to memory of 1564	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	111
PID 1564 wrote to memory of 2100	1564	cmd.exe	113
PID 3088 wrote to memory of 3464	3088	2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe	114
PID 3464 wrote to memory of 4100	3464	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_86e1cdc3a67ea7dadb5701dbbe073af4_akira_glassworm_rusty-stealer.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\priv_1776269980771.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2itah20n\2itah20n.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CD1.tmp" "c:\Users\Admin\AppData\Local\Temp\2itah20n\CSC5AC684A9EE0644CEB561F5CC542ECB58.TMP"
      4⤵
      PID:1496
- C:\Windows\system32\cmd.exe
  "cmd" /C systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil volume diskfree C:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\fsutil.exe
    fsutil volume diskfree C:
    3⤵
    PID:2080
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /T /IM librewolf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\cmd.exe
  "cmd" /C "ipconfig /all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2100
- C:\Windows\system32\cmd.exe
  "cmd" /C "ipconfig /displaydns"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\ipconfig.exe
    ipconfig /displaydns
    3⤵
    - Gathers network information
    PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2itah20n.dll

Path C:\Users\Admin\AppData\Local\Temp\2itah20n\2itah20n.dll
Size 4KB
SHA256 fceb7e8fbb6971a4759367e76de66140cecd33f4dd72f60b538ae7dbec581040
MD5 0aeb3bdd85dac29c5979c43bedff0af7
SHA1 1f5f36fa7100da0ec18172f9f8e8e0d751ca329b
SHA512 8d6181677860d373b70e0a2bee3d0d2a8a3f2e45022d656e26606e07adb33f3c21b0047a6133e3e4744d951b9088ccbc099588f885cf38dc49f00363f0911172
TLSH
T10E811E07D7E84A2BE4B74774AEF3071252B4F8209F73972F58D453696C906642E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES5CD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5CD1.tmp
Size 1KB
SHA256 83ff536e4003fd2382c79f2cc5dffbb17f1063942d8a91664a6b151c0f467284
MD5 63c85760fe9c535619a810ac573ec6ca
SHA1 daa287d0925a2508c08868263d54a83ae2ea61df
SHA512 92da285449d4f3f2c46c1d681d4d0c2208d0138f37bc434f5b839f575a6162589e7c9dfe61d295394f4f7b378010619bff8816bc17a1ec7c76d6d9ed35624bcc
TLSH
T1F221890947E94B1EF0B7973169F6132F9279FD64EFA2935B8580422C2C51154EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wgwyv1hz.jqg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgwyv1hz.jqg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

priv_1776269980771.ps1

Path C:\Users\Admin\AppData\Local\Temp\priv_1776269980771.ps1
Size 1KB
SHA256 d7dafbf9c9be01522a3a39b395c07cf4f7ef4bc1c538f98fc1e16f4d7d6e22a7
MD5 73968115f41a4b309566a31f3d6a72dd
SHA1 9c66cf144998fd3a7d3f7385b8a51f07739f6575
SHA512 2b484c9af761649ed24855dac11ad0ff558c9192b85e528b188c3f847ad0380b8e529e171ee69bbce53e5eda7bee087ae5981340355c8feb01f5e9a7184fed0c
TLSH
T16E31108963FA51B1C463A5BDD9D9F58BBD23003616FFEE11B27D53624F821268031626
MD5 SHA1 SHA512 TLSH

Submit Download

2itah20n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2itah20n\2itah20n.0.cs
Size 1KB
SHA256 54b820cfb35f02d4184f54185661c6674d8c784b47cdad1af601c9a3f4a6ee39
MD5 def92637cb211496a23377ca8b748bc2
SHA1 c2ce35f5d6c00a9a0e25e73b6ede71edd33a1964
SHA512 c7135b8843a80d94539034d570978096297d9331d70a65ced9818fe9abac04b02f27b78fcf9faf7edcb23d958fd13d7dac84711590c9b756ccd7ac2cec7d2413
TLSH
T17D21DF0863E692704453B95DDAC5F5CBB923013625FFAD21B17C53728F46126C43562A
MD5 SHA1 SHA512 TLSH

Submit Download

2itah20n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2itah20n\2itah20n.cmdline
Size 369B
SHA256 08effd6d87885589d0d871ff88a66eef740796035493db105ca933b16b6e0c2b
MD5 87396792ab28977834414af1b95766a1
SHA1 34b4ce002717c8ffef05c593df1f9a5d05c5b52d
SHA512 3111c2fd9d45bc80c223ebf3aa2b425efacc45e928fc85e0dac2d2ae74dbea900ec8adb05df5c49be21aa84494dd01b9313fdb7c4de70397e91494a9bb68e937
TLSH
T1C1E06F3B467AC27D01EE200B26BBC9AC87B207932E813FC4904B840DE027000AFD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5AC684A9EE0644CEB561F5CC542ECB58.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2itah20n\CSC5AC684A9EE0644CEB561F5CC542ECB58.TMP
Size 652B
SHA256 ee4d55048cd11e2ae7e383f8ba4c770bed2eae11e8149c3d6e486333ac1b5e7a
MD5 fb5d1a2907ffb08015dedca19a1bb87d
SHA1 352b1b73cd1f71c7b261b31e4b2c3a25ca705455
SHA512 2fd699ebc42cfd005f248cdeff060bccd3993fa6dd3bba237df122c8a3f0a71df3bbbdd50fc26ea45c645d86e918fe542ec2dcf129359187ca5978a7d37bd76b
TLSH
T160F05E0D63F8020EF0F38B30BDF6436391A9BC64DE7293ED5490132D2864510A962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-37-0x000001EB0ED20000-0x000001EB0EDCF000-memory.dmp

Download

memory/1836-33-0x000002A907CD0000-0x000002A907D7F000-memory.dmp

Download

memory/1896-34-0x00000210F3A30000-0x00000210F3ADF000-memory.dmp

Download

memory/2088-29-0x0000021ED7C90000-0x0000021ED7D3F000-memory.dmp

Download

memory/2184-30-0x000001DC10EE0000-0x000001DC10F8F000-memory.dmp

Download

memory/2216-38-0x00000238C6C70000-0x00000238C6D1F000-memory.dmp

Download

memory/3048-35-0x0000016B73840000-0x0000016B738EF000-memory.dmp

Download

memory/3088-46-0x00007FF7E9290000-0x00007FF7E962A000-memory.dmp

Download

memory/3088-36-0x00007FF7E9290000-0x00007FF7E962A000-memory.dmp

Download

memory/3908-28-0x0000027826BF0000-0x0000027826C02000-memory.dmp

Download

memory/3908-1-0x0000027826BE0000-0x0000027826BF0000-memory.dmp

Download

memory/3908-10-0x0000027826BE0000-0x0000027826BF0000-memory.dmp

Download

memory/3908-27-0x000002780E4D0000-0x000002780E57F000-memory.dmp

Download

memory/3908-2-0x0000027826BE0000-0x0000027826BF0000-memory.dmp

Download

memory/3908-8-0x0000027826C60000-0x0000027826C82000-memory.dmp

Download

memory/3908-24-0x0000027826CB0000-0x0000027826CB8000-memory.dmp

Download

memory/4388-32-0x000002C0F8420000-0x000002C0F84CF000-memory.dmp

Download

memory/4724-31-0x0000018EC4090000-0x0000018EC413F000-memory.dmp

Download