2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm
Size 310KB
Sample260517-nc4tkabt5k
SHA256 a7d2e645178c6a6b78c0216bb0b2cae583eb82ad60c07a4e7f10697bb65b7e25
MD5 f991e4a6d947b1f693364662a792cefc
SHA1 6b7127fd9a5281a28c6fa2fb459edc0842c961cd
SHA512 77a48eb964e061c18a9af20f6bb421945885013d4049d073e589a8de89b49712b1f82eee773592661b56b138d02abc7a6b19cbc4b67e69ad6dec36ab86d99ef6
SSDEEP 6144:1m2IPwQqT14oTPWPe2bR+Q4px41YvGSHJkb1I1BKhc93QhN:1mxG1/PMeY4pxZGSHJkb8Bcg3S
TLSH
T1AE648D57F69169BCE199C078935B8573BA73BC8E06207CBF13E496302E5AE212F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm

File Explorer

2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm

.exe 310KB

2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm

IMPHASH 52e74e455918938964a879131e40072c
SHA256 a7d2e645178c6a6b78c0216bb0b2cae583eb82ad60c07a4e7f10697bb65b7e25
MD5 f991e4a6d947b1f693364662a792cefc
SHA1 6b7127fd9a5281a28c6fa2fb459edc0842c961cd
SHA512 77a48eb964e061c18a9af20f6bb421945885013d4049d073e589a8de89b49712b1f82eee773592661b56b138d02abc7a6b19cbc4b67e69ad6dec36ab86d99ef6
SSDEEP 6144:1m2IPwQqT14oTPWPe2bR+Q4px41YvGSHJkb1I1BKhc93QhN:1mxG1/PMeY4pxZGSHJkb8Bcg3S
TLSH
T1AE648D57F69169BCE199C078935B8573BA73BC8E06207CBF13E496302E5AE212F2C715
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegOpenKeyExW RegQueryValueExW

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FormatMessageW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryExA MapViewOfFile Module32FirstW Module32NextW MoveFileW MultiByteToWideChar Process32FirstW Process32NextW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect WaitForSingleObject WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualQuery __C_specific_handler

ntdll

NtWriteFile RtlNtStatusToDosError

oleaut32

GetErrorInfo SysFreeString SysStringLen

user32

CloseClipboard GetClipboardData GetCursorPos GetSystemMetrics OpenClipboard

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

788B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-17_f991e4a6d947b1f693364662a792cefc_akira_glassworm

advapi32

bcrypt

iphlpapi

kernel32

ntdll

oleaut32

user32

api-ms-win-core-synch-l1-2-0

msvcrt

generic