dcd6866cf1025961870dd90a6614cbc11ee227e194610977060770411e323daa

General

Target
2026-06-30_78b3c072bbed0db9bf0ede71de737d8d_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260701-ev8qssf16w
SHA256 dcd6866cf1025961870dd90a6614cbc11ee227e194610977060770411e323daa
MD5 78b3c072bbed0db9bf0ede71de737d8d
SHA1 f1faf999ebba42d2887055d0da9098f5c287f5d0
SHA512 2360a4b7b3bef8d84f5b7918207894ce780be7f73c8e00cb817da81e8d153ee5c9b451d0bf6497eb16bb94cf3fb2ad163cfa675d26391cd2bd0f5d141c2dbc2e
SSDEEP 49152:gavY1Sn5eVNohi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZCymWsdGX:TY1aZJIig1VwkNU/mIzb4bpU
TLSH
T101C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-06-30_78b3c072bbed0db9bf0ede71de737d8d_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 dcd6866cf1025961870dd90a6614cbc11ee227e194610977060770411e323daa
- MD5 78b3c072bbed0db9bf0ede71de737d8d
- SHA1 f1faf999ebba42d2887055d0da9098f5c287f5d0
- SHA512 2360a4b7b3bef8d84f5b7918207894ce780be7f73c8e00cb817da81e8d153ee5c9b451d0bf6497eb16bb94cf3fb2ad163cfa675d26391cd2bd0f5d141c2dbc2e
- SSDEEP 49152:gavY1Sn5eVNohi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZCymWsdGX:TY1aZJIig1VwkNU/mIzb4bpU
- TLSH
  T101C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2