add818ce482b4894863a27ce66d4e1b224a2db8a7ff7f917444ebc54a13230c2

General

Target
2026-04-19_8a70e36fdb0e94bde472936688fbef48_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260419-eet8gaht5v
SHA256 add818ce482b4894863a27ce66d4e1b224a2db8a7ff7f917444ebc54a13230c2
MD5 8a70e36fdb0e94bde472936688fbef48
SHA1 8c5059f2eca5b71a5ad1f03e7f9e2abe94a218d6
SHA512 f9ae514ff25e34df6a27f8141fc0b8ee2067b13a566c866926251a62c42c21f9626cf21af7133d43a558635a19374626596ed785587e2ebfcd50d5276ef66c30
SSDEEP 49152:7avY1Sn5eVNoTi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZ7yPWsdGa:6Y1abJIig1VwkNU/mIzb4bpA
TLSH
T103C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-04-19_8a70e36fdb0e94bde472936688fbef48_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 add818ce482b4894863a27ce66d4e1b224a2db8a7ff7f917444ebc54a13230c2
- MD5 8a70e36fdb0e94bde472936688fbef48
- SHA1 8c5059f2eca5b71a5ad1f03e7f9e2abe94a218d6
- SHA512 f9ae514ff25e34df6a27f8141fc0b8ee2067b13a566c866926251a62c42c21f9626cf21af7133d43a558635a19374626596ed785587e2ebfcd50d5276ef66c30
- SSDEEP 49152:7avY1Sn5eVNoTi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZ7yPWsdGa:6Y1abJIig1VwkNU/mIzb4bpA
- TLSH
  T103C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Custom signature
  
  Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2