485ea540a877fff3cec3c9822b6b1f8fa4dcf92a596e9c97ad2997eb6e88a5c2

General

Target
2026-05-07_922b052a48ee7c46cc1e4e876b7c7c71_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260507-etyjfaex9v
SHA256 485ea540a877fff3cec3c9822b6b1f8fa4dcf92a596e9c97ad2997eb6e88a5c2
MD5 922b052a48ee7c46cc1e4e876b7c7c71
SHA1 3569ea401ac935bc7f075341a4d4f55e30fe2b5d
SHA512 28bcdf92b75dc1402ec48d20fb54c321a4145f28e7b814d0f93dfae31e29cd7f7fd72ec6fa7925541c7964b11ceb30f70316d53d9e11919ed4698d825a613679
SSDEEP 49152:qXnQVZVGzu9ui3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZRyWW19E:qXQVyJIig1VwkNU/mIzb4bpQ
TLSH
T159C59E0AE1538AD5CC6BC4BC838F7131EA357D79CA282E9F57C14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-05-07_922b052a48ee7c46cc1e4e876b7c7c71_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 485ea540a877fff3cec3c9822b6b1f8fa4dcf92a596e9c97ad2997eb6e88a5c2
- MD5 922b052a48ee7c46cc1e4e876b7c7c71
- SHA1 3569ea401ac935bc7f075341a4d4f55e30fe2b5d
- SHA512 28bcdf92b75dc1402ec48d20fb54c321a4145f28e7b814d0f93dfae31e29cd7f7fd72ec6fa7925541c7964b11ceb30f70316d53d9e11919ed4698d825a613679
- SSDEEP 49152:qXnQVZVGzu9ui3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZRyWW19E:qXQVyJIig1VwkNU/mIzb4bpQ
- TLSH
  T159C59E0AE1538AD5CC6BC4BC838F7131EA357D79CA282E9F57C14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2