ae9f288f9b4c83f8d4c57d1de5e597d1191e0785842a03685ce35c4a9a3b5bff

General

Target
2026-04-17_8f0f17aef77dd93d20a2418b74c5089e_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260417-eg85eahy2z
SHA256 ae9f288f9b4c83f8d4c57d1de5e597d1191e0785842a03685ce35c4a9a3b5bff
MD5 8f0f17aef77dd93d20a2418b74c5089e
SHA1 cfc775c83d903d8ebc36773d3abff78136585c5f
SHA512 4e729e99c4739af3108f902e124103c14188778d7a8f97b7db23998853cbbe4fda6fa6717027276519aafdef06efc8f1546f2130d69df6354b6a76ba247b2556
SSDEEP 49152:gavY1Sn5eVNoWi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZzypWsdGI:TY1a+JIig1VwkNU/mIzb4bpm
TLSH
T151C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-04-17_8f0f17aef77dd93d20a2418b74c5089e_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 ae9f288f9b4c83f8d4c57d1de5e597d1191e0785842a03685ce35c4a9a3b5bff
- MD5 8f0f17aef77dd93d20a2418b74c5089e
- SHA1 cfc775c83d903d8ebc36773d3abff78136585c5f
- SHA512 4e729e99c4739af3108f902e124103c14188778d7a8f97b7db23998853cbbe4fda6fa6717027276519aafdef06efc8f1546f2130d69df6354b6a76ba247b2556
- SSDEEP 49152:gavY1Sn5eVNoWi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZzypWsdGI:TY1a+JIig1VwkNU/mIzb4bpm
- TLSH
  T151C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2