2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer
Size 2.1MB
Sample260708-e9bdvabw9l
SHA256 215a3139e5090c7a925f09908bbff16ad126b7383a72df1f3b8bf6f366d5c729
MD5 54ecf0679c6d8436f35d20e12b1b3222
SHA1 23bbc499e037d87bef9f23929817957d2394f1dc
SHA512 3cabfa7e7d1e79a45ec7fd8d969697f09dc8eceb7480339e60e3433118708d3688be6c22a6cc7625a6f47993a0026106732438aee1b68c5340de3380ee8f1d9a
SSDEEP 49152:cm3+9EviBwylDVa00Zsd+qJDynagRpra7s1mrx+rU5IkMMA34IU6i4:cmuiGEgJD8a/FA3H+4
TLSH
T138A55C43F66280E8C569C4B9C35A6633BB32BC89473176EB17D457243E66FD06A3C709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer

File Explorer

2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer

.exe 2.1MB

2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer

IMPHASH a52827578c4e6efc9ba453794e54319a
SHA256 215a3139e5090c7a925f09908bbff16ad126b7383a72df1f3b8bf6f366d5c729
MD5 54ecf0679c6d8436f35d20e12b1b3222
SHA1 23bbc499e037d87bef9f23929817957d2394f1dc
SHA512 3cabfa7e7d1e79a45ec7fd8d969697f09dc8eceb7480339e60e3433118708d3688be6c22a6cc7625a6f47993a0026106732438aee1b68c5340de3380ee8f1d9a
SSDEEP 49152:cm3+9EviBwylDVa00Zsd+qJDynagRpra7s1mrx+rU5IkMMA34IU6i4:cmuiGEgJD8a/FA3H+4
TLSH
T138A55C43F66280E8C569C4B9C35A6633BB32BC89473176EB17D457243E66FD06A3C709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1539968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

updater.pdb

crypt32

CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateCertificateContext

kernel32

WriteFile DisconnectNamedPipe SetFileInformationByHandle MoveFileExW DeviceIoControl CreateFileW QueryPerformanceCounter SwitchToThread WaitForSingleObject LoadLibraryExA HeapAlloc GetCurrentProcess SetHandleInformation ConnectNamedPipe FindNextFileW FindClose GetModuleHandleA LoadLibraryA GetSystemTimePreciseAsFileTime HeapReAlloc CreateMutexW GetModuleFileNameW SetLastError GetLocalTime GetSystemFirmwareTable GetSystemTimeAsFileTime GetCurrentThreadId InitializeSListHead FindFirstFileExW IsDebuggerPresent GetLastError CloseHandle TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetEnvironmentVariableW CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceFrequency FormatMessageW GetTempPathW GetFileInformationByHandle GetFileInformationByHandleEx HeapFree GetFullPathNameW CreateDirectoryW GetProcessHeap IsProcessorFeaturePresent GetProcAddress GetCurrentProcessId GetModuleHandleW CreateNamedPipeW DeleteFileW ExitProcess CreateThread

secur32

DeleteSecurityContext FreeCredentialsHandle AcceptSecurityContext QueryContextAttributesW DecryptMessage AcquireCredentialsHandleA InitializeSecurityContextW EncryptMessage FreeContextBuffer

bcrypt

BCryptGenRandom

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken SystemFunction036

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

bcryptprimitives

ProcessPrng

oleaut32

SysFreeString GetErrorInfo SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSAGetLastError send closesocket setsockopt WSAStartup WSACleanup getaddrinfo ioctlsocket connect select recv WSARecv freeaddrinfo WSASocketW getsockopt getsockname getpeername WSASend WSADuplicateSocketW

user32

UpdateWindow SetTimer CreateWindowExW GetSystemMetrics TranslateMessage DispatchMessageW SetProcessDpiAwarenessContext SetForegroundWindow BringWindowToTop ShowWindow FindWindowW GetMessageW InvalidateRect ScreenToClient PostQuitMessage EndPaint BeginPaint DestroyWindow KillTimer RegisterClassExW MessageBoxW PostMessageW SetWindowPos DefWindowProcW

shell32

ShellExecuteExW

ole32

CoInitializeEx

dwmapi

DwmSetWindowAttribute

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

vcruntime140

memmove __current_exception memcpy memset memcmp __CxxFrameHandler3 __C_specific_handler __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf roundf

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _register_onexit_function _initialize_narrow_environment _set_app_type _seh_filter_exe _initterm __p___argv _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table exit _cexit _get_initial_narrow_environment _exit _c_exit __p___argc terminate _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_54ecf0679c6d8436f35d20e12b1b3222_akira_glassworm_rusty-stealer

crypt32

kernel32

secur32

bcrypt

advapi32

ntdll

bcryptprimitives

oleaut32

api-ms-win-core-synch-l1-2-0

ws2_32

user32

shell32

ole32

dwmapi

d2d1

dwrite

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic