aca9d4bed57df318418b43ef74dd77cca19a3a8aac5868a517218d4797c5ef2c

General

Target
2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Size 6.1MB
Sample260501-v2pt9set4r
SHA256 aca9d4bed57df318418b43ef74dd77cca19a3a8aac5868a517218d4797c5ef2c
MD5 cc87e9b204dc45f8644e832e2da4ea03
SHA1 3124d43321522d5fbe2766e5b034242e515040e6
SHA512 74ccca49b2a844c7031b87a4729e128fd2c1a830e61616f74b4b1fb32b08f6391158c693e37a22cd839f5a83b5fb0e85b456a398342ba23f07058309e53f257f
SSDEEP 98304:9Jj33ITj2BU4S4gMz+xtWNAIjDVFnGPv+xVle:HrojaS4gMz+qBRFGH+xV0
TLSH
T10D56BE43F6A581E9C09EC178C61B9233EBB2BC8A0620B79B67E84F112F57B605F5D345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe = "0"	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Executes dropped EXE 2 IoCs

pid	Process
4556	msedge_pwa_helper_2716.exe
836	msedge_pwa_helper_2716.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe = "0"	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
6	discord.com
7	discord.com
1	discord.com
4	discord.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4556	2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe	80
PID 4556 wrote to memory of 2460	4556	msedge_pwa_helper_2716.exe	82
PID 4556 wrote to memory of 2460	4556	msedge_pwa_helper_2716.exe	82
PID 2716 wrote to memory of 836	2716	2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe	85
PID 836 wrote to memory of 6088	836	msedge_pwa_helper_2716.exe	87
PID 836 wrote to memory of 6088	836	msedge_pwa_helper_2716.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-01_cc87e9b204dc45f8644e832e2da4ea03_akira_glassworm_rusty-stealer.exe"
1⤵
- Windows security bypass
- Windows security modification
- Maps connected drives based on registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_2716.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_2716.exe" --output-path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_2716 chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_2716.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_2716.exe" --output-path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_2716 edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nRc7oqcH.bmp

Path C:\Users\Admin\AppData\Local\Temp\MGWGdcOM8P\nRc7oqcH.bmp
Size 5.9MB
SHA256 1062ec75d3200a340cbbb0ab45dc40d2202132540935f6bbd533bdf514a54882
MD5 874bbf78ef575a92a5d741a6f1df640b
SHA1 67e942dce883ff13d4a340bbe39dd72a9e8f0e01
SHA512 bd206c20f3045d301d284fe7f516e388861ef715225eb5e7b9840cd91c6748d3bd7e301bc5ada9626165969de68131a89dc792c19d3b690cf7bbfda5071c47e3
SSDEEP 12288:yW5u04fy10KlK/Q5AUT7dO+3PujjS3BCnkGqu:yW5u047KlK/QB/3cTqu
TLSH
T13356E323F5EA7D64FA2A39B582F4071DA314E8D8B748074E8529F8F0F1923456DB76B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbxhrvwl.zip

Path C:\Users\Admin\AppData\Local\Temp\cbxhrvwl.zip
Size 846B
SHA256 aa9f2df6bd1d505fd0f44cb7099ef1a11c8a499bc60806cb0595a07fb0cfb20c
MD5 aa214bbc8c4adab8d531e1a9d260445f
SHA1 65e58bb2b4605e5a47731153742ed90716ef9588
SHA512 4bf9fadc7312c8ec40f017f46da83d94e40e18e2060732b9bec02e896a140a0cc72116a94b2483a92a8fe758f8db46ef75dcd8e21b84e62a569727fad640434f
TLSH
T168014640B85FC33AC4554371D00213B7523F69C15665BB1934A1A474C9221DD2EC6F95
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_2716\Chrome\Default\cookies.json
Size 349B
SHA256 0b30dbc20e580cc92554921c86406e957161baef6dff0d005eea7b72ab3ffe8a
MD5 8b825b19a0e80957c470bec2eaaa9a07
SHA1 5a02c95094a8a0321ab7cec12888e278d281534c
SHA512 a43b84cf267248de69727a6cdfc6810e549cfc8bab54b5e1a371d6d5a8f8645765723aec57ea6eb1000f26c69a9d17434e4ff47bfb6e187803d073d3c5fcb8e1
TLSH
T112E0C08F14C1282BDA0A561A2A725E2D7D3A931107B5DDAA503F8422F264D3C218A28B
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\edge_pwa_out_2716\Edge\Default\cookies.json
Size 312B
SHA256 4fd69e72c65c668f42bdc57ef60e500ff4860ff2d0259177a09469771da4b76c
MD5 a137ed334d922a53681bcdb8e9370bcc
SHA1 eeb0387a78632c8a0e412a39fcce2ce13fede98c
SHA512 41ea83df23f934396f614fe156059c1060e2b3f10cc38814c983a1099db08e7789c654f98824c3bd10d490827124c00b517019377329c50828a4b6623c37d7f1
TLSH
T1C0E07D89A08904B3C73F899B9D138FAA781CE6735205FE830224C089444134A64418D7
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_helper_2716.exe

Path C:\Users\Admin\AppData\Local\Temp\msedge_pwa_helper_2716.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads