2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer
Size 3.9MB
Sample260707-rr3ftsft6x
SHA256 5a36eb86d92549e4a366dda089dc4b19a5f3785b675cb6d92dacddfa1315db83
MD5 56326832ffb36362395f7e378c75f809
SHA1 ee665a4f60c55d9a3be06b19934e085c671506a1
SHA512 e55e28f25a7ca9348124ceca03f38084252ec5c731ce73be3a55a40850e0370abccd0030dc2137e184a41fbd5c82e5f394b489e497bbec288fb016f3d0f2013a
SSDEEP 49152:MiR9WHetB2A8OQA+XjbyXELRAKFxzKljnf0jS6ZpzI7odP1f59G2A8TJ0u/SF1YC:M2WK2AkGs3t2CKGN/JrFls
TLSH
T1F4166C43F69581E9C09EC178C72A9237EB72BC8E4620B79B5BD44A212F93B705F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer

File Explorer

2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer

.exe 3.9MB

2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer

IMPHASH f408a39d54dbf78666bf4f40790a83bb
SHA256 5a36eb86d92549e4a366dda089dc4b19a5f3785b675cb6d92dacddfa1315db83
MD5 56326832ffb36362395f7e378c75f809
SHA1 ee665a4f60c55d9a3be06b19934e085c671506a1
SHA512 e55e28f25a7ca9348124ceca03f38084252ec5c731ce73be3a55a40850e0370abccd0030dc2137e184a41fbd5c82e5f394b489e497bbec288fb016f3d0f2013a
SSDEEP 49152:MiR9WHetB2A8OQA+XjbyXELRAKFxzKljnf0jS6ZpzI7odP1f59G2A8TJ0u/SF1YC:M2WK2AkGs3t2CKGN/JrFls
TLSH
T1F4166C43F69581E9C09EC178C72A9237EB72BC8E4620B79B5BD44A212F93B705F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2845520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

newwapcu.pdb

crypt32

CryptUnprotectData CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore

kernel32

GetFileInformationByHandleEx GetLastError CloseHandle SetFileInformationByHandle SwitchToThread FindClose Process32Next Process32First CreateToolhelp32Snapshot OpenProcess GetModuleHandleW GetProcAddress GetCurrentProcess SetFileAttributesW LocalFree GetCurrentProcessId GetConsoleWindow GetSystemInfo CreateMutexW IsDebuggerPresent GlobalMemoryStatusEx GetTickCount64 GlobalLock GlobalUnlock GlobalSize AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetTimeZoneInformationForYear SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFileInformationByHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep FindNextFileW SetFilePointerEx PostQueuedCompletionStatus LoadLibraryExA InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile CreateFileMappingW HeapCompact LoadLibraryW MapViewOfFile CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetTickCount FlushFileBuffers DeleteFileA HeapDestroy

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtQueryInformationProcess RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile NtCreateFile

ws2_32

ioctlsocket WSASocketW WSASend shutdown getsockopt bind WSAStartup WSACleanup freeaddrinfo recv setsockopt getaddrinfo WSAIoctl getsockname getpeername closesocket WSAGetLastError connect send

advapi32

LookupPrivilegeValueA DuplicateTokenEx RevertToSelf GetTokenInformation RegEnumKeyExW OpenProcessToken RegCloseKey RegOpenKeyExW RegDeleteValueW RegSetValueExW RegQueryValueExW SetThreadToken AdjustTokenPrivileges RegCreateKeyExW RegEnumValueW

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

secur32

AcquireCredentialsHandleA QueryContextAttributesW DecryptMessage ApplyControlToken InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage FreeCredentialsHandle DeleteSecurityContext

bcryptprimitives

ProcessPrng

oleaut32

VariantClear SysAllocStringLen SysStringLen GetErrorInfo SysFreeString

user32

ReleaseDC SendMessageTimeoutW EnumClipboardFormats GetClipboardData CloseClipboard GetCursorPos SetWindowPos ShowWindow GetSystemMetrics GetWindowLongPtrW SetWindowLongPtrW MessageBoxW GetWindowDC GetDesktopWindow OpenClipboard

ole32

CoInitializeEx CoCreateInstance CoUninitialize

gdi32

BitBlt GetDIBits SelectObject DeleteObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC

vcruntime140

memmove __current_exception_context memcpy memset __current_exception memcmp __CxxFrameHandler3 __C_specific_handler strrchr memchr strchr

api-ms-win-crt-string-l1-1-0

strncmp strcspn strcmp strspn strlen

api-ms-win-crt-heap-l1-1-0

free malloc _msize _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr fabs log

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _exit exit _initterm_e _initterm __p___argc _crt_atexit _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv terminate _c_exit _cexit _beginthreadex _register_onexit_function _set_app_type _seh_filter_exe _endthreadex _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_56326832ffb36362395f7e378c75f809_akira_glassworm_rusty-stealer

crypt32

kernel32

ntdll

ws2_32

advapi32

ncrypt

api-ms-win-core-synch-l1-2-0

secur32

bcryptprimitives

oleaut32

user32

ole32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic