2026-05-06_470ad90956c6ec56af1d964c2c13ae0d_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_470ad90956c6ec56af1d964c2c13ae0d_akira_glassworm_rusty-stealer
Size 720KB
Sample260506-tmvxases3x
SHA256 3f1377fc199edf10b213dc52f20b4c273848ddc108d8a017d080607bc5d7284f
MD5 470ad90956c6ec56af1d964c2c13ae0d
SHA1 761e3501e67fd4e0f47fb6e840cc92128fbe6ddc
SHA512 238e157186f4e5c608a6d5c6637b5732a26e99c8e817923ce18d1f99683e0df8e9745d18263d88fb46ae49f50a7a690e1b73d9e36126f216cf4f5da2d35a990d
SSDEEP 12288:WWBNjGXN/6M043cqYsVfZV8ZiicifJIBmEeGojTAJi:WqN6v0UY4B+XciRIAEenTAJi
TLSH
T14EF42A21BF5A9AADD44AC475834A85B36A3274CB1B36B9FF418451383EB9AF41F3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-06_470ad90956c6ec56af1d964c2c13ae0d_akira_glassworm_rusty-stealer

.exe 720KB

2026-05-06_470ad90956c6ec56af1d964c2c13ae0d_akira_glassworm_rusty-stealer

IMPHASH ad1be8aad497b2a96b78045576ce7acb
SHA256 3f1377fc199edf10b213dc52f20b4c273848ddc108d8a017d080607bc5d7284f
MD5 470ad90956c6ec56af1d964c2c13ae0d
SHA1 761e3501e67fd4e0f47fb6e840cc92128fbe6ddc
SHA512 238e157186f4e5c608a6d5c6637b5732a26e99c8e817923ce18d1f99683e0df8e9745d18263d88fb46ae49f50a7a690e1b73d9e36126f216cf4f5da2d35a990d
SSDEEP 12288:WWBNjGXN/6M043cqYsVfZV8ZiicifJIBmEeGojTAJi:WqN6v0UY4B+XciRIAEenTAJi
TLSH
T14EF42A21BF5A9AADD44AC475834A85B36A3274CB1B36B9FF418451383EB9AF41F3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e9:46:7c:9a:49:65:37:ba:85:fa:1b:20:24:fc:e6:8b:b3:51:39:62:7a:01:63:4f:21:fd:b3:b3:83:34:9f:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Chains

Apr 30, 2026

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Serial Number

33:00:00:97:70:9e:97:cc:8c:18:ce:20:36:00:00:00:00:97:70

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2026 - May 2, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

494608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_windows_sandbox_setup.pdb

kernel32

DuplicateHandle CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW ReadFileEx SleepEx WriteFileEx GetCurrentThreadId RtlLookupFunctionEntry GetFileAttributesW GetConsoleOutputCP GetConsoleMode ReleaseMutex lstrlenW CreateMutexW GetStdHandle FindClose OpenMutexW WriteConsoleW GetModuleFileNameW CreateFileW LocalFree GetSystemTimePreciseAsFileTime HeapReAlloc MultiByteToWideChar FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW GetFileInformationByHandleEx CreateThread GetModuleHandleA GetTimeZoneInformationForYear LoadLibraryExA GetSystemTimeAsFileTime FormatMessageW GetLastError IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc CloseHandle HeapFree GetFileInformationByHandle SetFileInformationByHandle CreateDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee SwitchToThread WaitForSingleObject CreateMutexA GetCurrentProcessId GetModuleHandleW LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte GetProcAddress GetCurrentProcess GetFullPathNameW GetProcessHeap SetUnhandledExceptionFilter GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext UnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead RtlVirtualUnwind AddVectoredExceptionHandler GetCurrentDirectoryW

advapi32

GetAce EqualSid GetAclInformation GetSecurityInfo GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW RegSetValueExW ConvertStringSidToSidW ConvertSidToStringSidW RegCreateKeyExW SystemFunction036 LookupAccountNameW GetLengthSid CopySid LookupAccountSidW MapGenericMask RegCloseKey

oleaut32

SysStringLen SysFreeString GetErrorInfo SysAllocStringLen

bcryptprimitives

ProcessPrng

crypt32

CryptProtectData

bcrypt

BCryptGenRandom

ole32

CoCreateInstance CoInitializeEx CoUninitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtReadFile NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile

netapi32

NetLocalGroupAddMembers NetUserSetInfo NetUserAdd NetLocalGroupAdd

vcruntime140

memset __CxxFrameHandler3 memcpy __C_specific_handler memmove memcmp __current_exception _CxxThrowException __current_exception_context

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _exit exit _c_exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_470ad90956c6ec56af1d964c2c13ae0d_akira_glassworm_rusty-stealer

kernel32

advapi32

oleaut32

bcryptprimitives

crypt32

bcrypt

ole32

api-ms-win-core-synch-l1-2-0

ntdll

netapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic