775204330bbbc3e29258c0a51099c75b319e76dc9e78eb8079855266c20eabe7

General

Target
2026-07-07_34979e9035997a99f7815e7b5a016174_akira_glassworm_rusty-stealer
Size 1.4MB
Sample260707-j7261aax9m
SHA256 775204330bbbc3e29258c0a51099c75b319e76dc9e78eb8079855266c20eabe7
MD5 34979e9035997a99f7815e7b5a016174
SHA1 4f1674822adc9c07d908d293be0e6c3c725ae4f1
SHA512 85aa6f411199e24089109443e5b25dc04dc027d03c29054660673478c895353b8d9338462070bda8858ff0d77dd5f87f5cab4536ab40924ef3625f2bf16150e8
SSDEEP 24576:82lx11eBUYKDZyhtvlk61TRuQJlBhkftdGmMyFM3VIH06iyg:llxPeBUGW6pRhJhCEMYIU6i7
TLSH
T1B3658D03E69181EDC45DC4B8C3578A36AA36BC8E0B3076EF17D45A112E2AFD16F2DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-07_34979e9035997a99f7815e7b5a016174_akira_glassworm_rusty-stealer
- Size 1.4MB
- SHA256 775204330bbbc3e29258c0a51099c75b319e76dc9e78eb8079855266c20eabe7
- MD5 34979e9035997a99f7815e7b5a016174
- SHA1 4f1674822adc9c07d908d293be0e6c3c725ae4f1
- SHA512 85aa6f411199e24089109443e5b25dc04dc027d03c29054660673478c895353b8d9338462070bda8858ff0d77dd5f87f5cab4536ab40924ef3625f2bf16150e8
- SSDEEP 24576:82lx11eBUYKDZyhtvlk61TRuQJlBhkftdGmMyFM3VIH06iyg:llxPeBUGW6pRhJhCEMYIU6i7
- TLSH
  T1B3658D03E69181EDC45DC4B8C3578A36AA36BC8E0B3076EF17D45A112E2AFD16F2DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer trojan adware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2