56b81106aa9669997b2659c83183b3ff84fd7a910f5c148b2365fbb2ae23620d

General

Target
2026-05-04_a0cf0b99aa5d70a0af6d9184dc2995f8_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260504-lt45jsbw7q
SHA256 56b81106aa9669997b2659c83183b3ff84fd7a910f5c148b2365fbb2ae23620d
MD5 a0cf0b99aa5d70a0af6d9184dc2995f8
SHA1 d2b213b07a6207dc5734255709ac021ec5d874e6
SHA512 b5fc6444b1a1989294b6177380796e40b94e3ff828d77f94632eeb342e98d321d31034bab10d5c32543561ab3e83b889ca162c0adfda9e106f87b9fc92403267
SSDEEP 49152:CXnQVZVGzu9ii3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZAyOW19E:CXQVOJIig1VwkNU/mIzb4bpB
TLSH
T132C59E0AE1538AD5CC6BC4BC838F7131EA357D79CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-05-04_a0cf0b99aa5d70a0af6d9184dc2995f8_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 56b81106aa9669997b2659c83183b3ff84fd7a910f5c148b2365fbb2ae23620d
- MD5 a0cf0b99aa5d70a0af6d9184dc2995f8
- SHA1 d2b213b07a6207dc5734255709ac021ec5d874e6
- SHA512 b5fc6444b1a1989294b6177380796e40b94e3ff828d77f94632eeb342e98d321d31034bab10d5c32543561ab3e83b889ca162c0adfda9e106f87b9fc92403267
- SSDEEP 49152:CXnQVZVGzu9ii3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZAyOW19E:CXQVOJIig1VwkNU/mIzb4bpB
- TLSH
  T132C59E0AE1538AD5CC6BC4BC838F7131EA357D79CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Custom signature
  
  Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2