2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer
Size 12.9MB
Sample260518-mtm2psex3j
SHA256 e36d84d86cf0703f193049947a44a7e0d99c32b952174a758aa23b68b695d422
MD5 9f405dd8bf2b473194e6bf507fb7eda7
SHA1 81b452a7f93a6c45c3e88fc4b5c9495f41c1b4cd
SHA512 cbe214918b0405320cb6c2bdf05188ff581a77c25c12b24e86c2e48b9f8f5ce19f2529a43e5992b568a304107913cb33b8c4bdec3ade61e11a15935fd059e30f
SSDEEP 98304:MpA+WmOBYWipnGSsdFFMQI0DJVzQCrhgKLCj4yuMI4zLXcy7H+dj8PFIVnsZ38:T+yBlvFFIGX6iZyuhOcAs
TLSH
T1B5D609117A9BA8ACD19AC870834A8A631E2130DB1B36B9FF44D455393F6DBF15F38718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer

File Explorer

2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer

.exe 12.9MB

2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer

IMPHASH a7cde0a801d87ca0db4990f1361d2697
SHA256 e36d84d86cf0703f193049947a44a7e0d99c32b952174a758aa23b68b695d422
MD5 9f405dd8bf2b473194e6bf507fb7eda7
SHA1 81b452a7f93a6c45c3e88fc4b5c9495f41c1b4cd
SHA512 cbe214918b0405320cb6c2bdf05188ff581a77c25c12b24e86c2e48b9f8f5ce19f2529a43e5992b568a304107913cb33b8c4bdec3ade61e11a15935fd059e30f
SSDEEP 98304:MpA+WmOBYWipnGSsdFFMQI0DJVzQCrhgKLCj4yuMI4zLXcy7H+dj8PFIVnsZ38:T+yBlvFFIGX6iZyuhOcAs
TLSH
T1B5D609117A9BA8ACD19AC870834A8A631E2130DB1B36B9FF44D455393F6DBF15F38718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9332380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tensorlake.pdb

bcryptprimitives

ProcessPrng

kernel32

CancelIoEx GetFinalPathNameByHandleW SetLastError SleepEx SetFileCompletionNotificationModes CreateIoCompletionPort WriteFileEx WaitForMultipleObjects GetOverlappedResult GetCurrentThreadId WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex CreateFileW GetNumberOfConsoleInputEvents MultiByteToWideChar WriteConsoleW ReadConsoleInputW ReadFileEx GetFileInformationByHandleEx GetQueuedCompletionStatusEx SetHandleInformation GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle FillConsoleOutputAttribute ReadConsoleW CreateDirectoryW ExitProcess CreateEventW WriteFile TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle FillConsoleOutputCharacterA DeviceIoControl GetFileType SetConsoleTextAttribute GetCurrentThread FindNextFileW SetConsoleCtrlHandler SetFilePointerEx SetThreadStackGuarantee GetConsoleScreenBufferInfo RegisterWaitForSingleObject PostQueuedCompletionStatus UnregisterWaitEx SwitchToThread SetConsoleCursorPosition SetConsoleCursorInfo SetNamedPipeHandleState GetConsoleCursorInfo GetProcessHeap HeapFree HeapReAlloc GetCommandLineW AddVectoredExceptionHandler SetConsoleMode RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetConsoleMode CreateThread lstrlenW CancelIo GetSystemInfo GetExitCodeProcess WaitForSingleObject GetComputerNameExW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime IsProcessorFeaturePresent InitializeSListHead GetStdHandle IsDebuggerPresent GetTimeZoneInformationForYear UnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep CloseHandle GetLastError ReadFile GetConsoleOutputCP SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

send socket WSASend WSACleanup recv WSAStartup freeaddrinfo ioctlsocket WSASocketW getsockname getpeername getsockopt connect setsockopt shutdown WSAIoctl WSAGetLastError accept listen bind closesocket getaddrinfo

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertSetCertificateContextProperty CertCloseStore CertCreateCertificateChainEngine CertFreeCertificateContext CertAddEncodedCertificateToStore

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memset _CxxThrowException __C_specific_handler __current_exception memmove __current_exception_context memcpy __CxxFrameHandler3 memcmp

api-ms-win-crt-math-l1-1-0

ceilf ceil round floorf pow trunc truncf __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_initterm _register_onexit_function _initialize_narrow_environment _initterm_e exit _exit _crt_atexit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _configure_narrow_argv terminate _set_app_type _get_initial_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-18_9f405dd8bf2b473194e6bf507fb7eda7_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

shell32

combase

ntdll

crypt32

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic