2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer
Size 650KB
Sample260709-saqldads91
SHA256 49172ba0932489ff76a7b526a0077a8a295456ef1b6233532bb642dce00ca15a
MD5 381c04324b408818cb1033bd2f55b550
SHA1 ce11e19b011b178dc70e08ac95c8b24c5e6d652c
SHA512 1fa9dbd6b02ad7baa7cda099904e7cbedaf8f8b894d66ff6daedcf84706df0edeb992904dfc347a0d6a1104655d7c12ff3218dbce64efca141fa108ce7fa6c2b
SSDEEP 12288:gghZdFsgUq8VmGVGrciQVAZkPGbUk7zloEE3oBB:ldFbXkVGrcrA8BoB
TLSH
T18FE44A03F6C445E8E05DC075C35A9633AB73B88A0721B2EF17D45A212F29EA5AF3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer

File Explorer

2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer

.exe 650KB

2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer

IMPHASH 30fbb69816bc7f837563a055a6957b65
SHA256 49172ba0932489ff76a7b526a0077a8a295456ef1b6233532bb642dce00ca15a
MD5 381c04324b408818cb1033bd2f55b550
SHA1 ce11e19b011b178dc70e08ac95c8b24c5e6d652c
SHA512 1fa9dbd6b02ad7baa7cda099904e7cbedaf8f8b894d66ff6daedcf84706df0edeb992904dfc347a0d6a1104655d7c12ff3218dbce64efca141fa108ce7fa6c2b
SSDEEP 12288:gghZdFsgUq8VmGVGrciQVAZkPGbUk7zloEE3oBB:ldFbXkVGrcrA8BoB
TLSH
T18FE44A03F6C445E8E05DC075C35A9633AB73B88A0721B2EF17D45A212F29EA5AF3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

486652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

webview.pdb

kernel32

RtlLookupFunctionEntry GetCurrentProcess HeapReAlloc HeapFree GetProcessHeap GetCurrentThread WaitForSingleObjectEx GetModuleHandleW GetModuleFileNameW LCIDToLocaleName LoadLibraryW FormatMessageW LoadLibraryA lstrlenW WaitForSingleObject SetWaitableTimer SetThreadStackGuarantee HeapAlloc MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLastError WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId SwitchToThread GetSystemTimeAsFileTime WideCharToMultiByte IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess ReadConsoleW LoadLibraryExA WriteConsoleW GetConsoleOutputCP OutputDebugStringA OutputDebugStringW LoadLibraryExW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode FreeLibrary GetConsoleMode GetStdHandle ReleaseMutex ExitProcess SetLastError GetCurrentProcessId GetProcAddress GetModuleHandleA Sleep CloseHandle GetUserDefaultUILanguage CreateFileW InitializeSListHead UnhandledExceptionFilter SetFileTime SetFileInformationByHandle CreateThread QueryPerformanceCounter CreateWaitableTimerExW SetUnhandledExceptionFilter GetFinalPathNameByHandleW GetFileInformationByHandle GetFileInformationByHandleEx FindNextFileW FindClose FindFirstFileExW GetCommandLineW GetFileType AddVectoredExceptionHandler GetFileAttributesW QueryPerformanceFrequency GetCurrentDirectoryW RtlCaptureContext CreateMutexA RtlVirtualUnwind GetEnvironmentVariableW GetFullPathNameW

ntdll

RtlGetVersion NtWriteFile RtlNtStatusToDosError NtReadFile

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

user32

EnableMenuItem GetSystemMenu SetWindowPlacement GetWindowPlacement ShowWindow DestroyIcon GetMenu ReleaseCapture SetCapture GetActiveWindow GetClipCursor ClipCursor RegisterWindowMessageA ShowCursor GetKeyboardLayout GetClientRect SetWindowPos PostMessageW EnumChildWindows SetWindowLongW GetDC MapVirtualKeyExW GetWindowLongPtrW GetWindowRect SetWindowDisplayAffinity GetKeyboardState SetForegroundWindow RegisterTouchWindow IsWindow AdjustWindowRectEx MonitorFromPoint EnumDisplayMonitors RegisterClassExW RegisterRawInputDevices CreateWindowExW SendMessageW DestroyWindow DispatchMessageA GetMessageA IsProcessDPIAware InvalidateRgn MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData GetMonitorInfoW SetCursor LoadCursorW FillRect MonitorFromWindow GetCursorPos GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo MonitorFromRect ScreenToClient TrackMouseEvent SystemParametersInfoW ClientToScreen GetWindowLongW DefWindowProcW GetKeyState GetAsyncKeyState RedrawWindow SetWindowLongPtrW MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW GetMessageW PostThreadMessageW SystemParametersInfoA SetPropW GetWindow SetFocus ChangeDisplaySettingsExW SendInput ToUnicodeEx

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc

gdi32

DeleteObject CreateRectRgn GetDeviceCaps CreateSolidBrush

shlwapi

SHCreateMemStream

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

ole32

CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc CoUninitialize RegisterDragDrop RevokeDragDrop CoInitializeEx OleInitialize

shell32

DragFinish SHAppBarMessage DragQueryFileW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegGetValueW EventSetInformation EventWriteTransfer EventUnregister EventRegister

bcryptprimitives

ProcessPrng

vcruntime140

memcmp memcpy memset _purecall __current_exception memmove __CxxFrameHandler3 __current_exception_context __std_exception_copy __C_specific_handler __std_exception_destroy _CxxThrowException wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

floor trunc roundf round __setusermatherr

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscmp wcslen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_c_exit _initterm_e _get_initial_narrow_environment _initialize_narrow_environment exit _configure_narrow_argv _seh_filter_exe _set_app_type _cexit _initterm __p___argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit __p___argc _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_381c04324b408818cb1033bd2f55b550_akira_rusty-stealer

kernel32

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

user32

comctl32

gdi32

shlwapi

dwmapi

ole32

shell32

advapi32

bcryptprimitives

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic