aca9d4bed57df318418b43ef74dd77cca19a3a8aac5868a517218d4797c5ef2c

General

Target
2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Size 6.1MB
Sample260501-v2pt9set4r
SHA256 aca9d4bed57df318418b43ef74dd77cca19a3a8aac5868a517218d4797c5ef2c
MD5 cc87e9b204dc45f8644e832e2da4ea03
SHA1 3124d43321522d5fbe2766e5b034242e515040e6
SHA512 74ccca49b2a844c7031b87a4729e128fd2c1a830e61616f74b4b1fb32b08f6391158c693e37a22cd839f5a83b5fb0e85b456a398342ba23f07058309e53f257f
SSDEEP 98304:9Jj33ITj2BU4S4gMz+xtWNAIjDVFnGPv+xVle:HrojaS4gMz+qBRFGH+xV0
TLSH
T10D56BE43F6A581E9C09EC178C61B9233EBB2BC8A0620B79B67E84F112F57B605F5D345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe = "0"	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Executes dropped EXE 2 IoCs

pid	Process
3948	msedge_pwa_helper_4760.exe
2856	msedge_pwa_helper_4760.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe = "0"	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
27	discord.com
45	discord.com
46	discord.com
51	discord.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3948	4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe	93
PID 3948 wrote to memory of 5072	3948	msedge_pwa_helper_4760.exe	95
PID 3948 wrote to memory of 5072	3948	msedge_pwa_helper_4760.exe	95
PID 4760 wrote to memory of 2856	4760	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe	98
PID 2856 wrote to memory of 4048	2856	msedge_pwa_helper_4760.exe	100
PID 2856 wrote to memory of 4048	2856	msedge_pwa_helper_4760.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe"
1⤵
- Windows security bypass
- Windows security modification
- Maps connected drives based on registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_4760.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_4760.exe" --output-path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_4760 chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5072
- C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_4760.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_4760.exe" --output-path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_4760 edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2wANsvKt.bmp

Path C:\Users\Admin\AppData\Local\Temp\cJDCUmClFF\2wANsvKt.bmp
Size 5.9MB
SHA256 9685326c27f3be71b8cb7391a02a38ec29e90daa8041fa915353dcc6eedee782
MD5 c7f5a4abc27c7eb0adfc6c2b6b213f2f
SHA1 5878edddf3ad817b68c7d36a1f8ba96a476751f5
SHA512 c0c01a4e6064f7d6babe1af5a878bda7c5dfdb4709909532ffd7c844283c026e04c187a84319f832f6f377e8fa22e077f97d5f5e33cc66e9271d42bffd4bbc11
SSDEEP 12288:/hWBXaFH6nIXKKbU8FyiCeojj+JH97I7jLqm:/hWBXaFuI6xiJH907/qm
TLSH
T104561423F6EA7A44EA3A797582F4071DA310ECD8B748078F852578F4F0923856D77AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_4760\Chrome\Default\cookies.json
Size 349B
SHA256 9944ff9b892acd02b9de0643ef57c5e538984847e5fabd97a8215438be67ccb7
MD5 22524f795e123f0580c1b1b3ec5d61e2
SHA1 42bbdeb17ab01ccb087ad8b25ba00846c70574b3
SHA512 869cca1f4f49d9fb9282b6a677946fc709a883da9ef74ba42fbe3e109635ec96351702f9c53ecebb24ea58caadfff85796b57e13289c404911e79b79666a432f
TLSH
T10FE0685A59E12C1BC947C024E80245AC702462524619FEDA58B490564A00F2EB3674D7
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_4760\Edge\Default\cookies.json
Size 312B
SHA256 281a89ab726b94957238f238408accdde891277f3abfcfc169bb955bd03f97da
MD5 f3f935c3ef630ceb4d47970bccea8d3d
SHA1 c054d3e565cd17d762da614b0acbbebb2b9b1491
SHA512 1925bf8a8994104c91dc65c4a8059450003624413e0d44e603fce9c377f5660f7a5603f93b39986bdb0827e8ad928f7f60c17eb3adfe71097b0c969c114aa6c6
TLSH
T15DE07D5C59CF815BC95BE6128C5146D47CAA2B12053DFE3FE0685464A9B151621074B6
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_helper_4760.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_4760.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yjughzyk.zip

Path C:\Users\Admin\AppData\Local\Temp\yjughzyk.zip
Size 846B
SHA256 94c1976e3e81087231152cc68ffa806f09d2e32b6ee4d529b12a91b5b8a39678
MD5 722bcc86b4de91552d3c8037c86604bb
SHA1 6d87b4d653d9551a04222ea0296cabb8333e895f
SHA512 d5bda57cfef409025192a37c80fb67ef8322357e9ea0b4c86a1c0042c1d8435e7d5ffa737d9a79fe4239885368a3d88a2ff45a2301923d9de72f45736d0c3360
TLSH
T1430175A87D8FE32EC9A85770C0A4538E9B7B19C050B5B10F4C523890CF935873C80B04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4760-0-0x000001A443870000-0x000001A44390B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads