4ca4b29e4a73c6bd7f780f278d10a20e4790deaa18044bd2b455998d72fc3a15

General

Target
2026-07-05_c704f8115ed7bb54d34da88da2c8f374_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260705-tbcxcadv3y
SHA256 4ca4b29e4a73c6bd7f780f278d10a20e4790deaa18044bd2b455998d72fc3a15
MD5 c704f8115ed7bb54d34da88da2c8f374
SHA1 ec3788a64104bc3ce1fddac3722c95b389044d6d
SHA512 2809341417f92423dbaa7ada9daf801efb1cc03f48fa9d3d0114491000c78895f27a6f63df0ecc7f4df4ed0cba2afe5fcd358d686337f05f319de4047c996bcd
SSDEEP 49152:3avY1Sn5eVNoAi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZyySWsdGV:OY1aYJIig1VwkNU/mIzb4bpU
TLSH
T117C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613B45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-05_c704f8115ed7bb54d34da88da2c8f374_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 4ca4b29e4a73c6bd7f780f278d10a20e4790deaa18044bd2b455998d72fc3a15
- MD5 c704f8115ed7bb54d34da88da2c8f374
- SHA1 ec3788a64104bc3ce1fddac3722c95b389044d6d
- SHA512 2809341417f92423dbaa7ada9daf801efb1cc03f48fa9d3d0114491000c78895f27a6f63df0ecc7f4df4ed0cba2afe5fcd358d686337f05f319de4047c996bcd
- SSDEEP 49152:3avY1Sn5eVNoAi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZyySWsdGV:OY1aYJIig1VwkNU/mIzb4bpU
- TLSH
  T117C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613B45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2