9127fa31f9e18d479dceff38f99eda6837f60d40678eb731b84428d123e354cb

General

Target
2026-07-11_12cbc2e337a79641c6f5341aa954156e_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260711-vledlahw41
SHA256 9127fa31f9e18d479dceff38f99eda6837f60d40678eb731b84428d123e354cb
MD5 12cbc2e337a79641c6f5341aa954156e
SHA1 5d12bab78457be8bfba1222170b1e82cc699c5de
SHA512 f954609bc382a65490fcb8d977f9966491da1ce3908cf16f33b077803cdc4fe570befeb2618cd1e8b1f0851baea18c4e3858d9b0b0d96415c95402491085fda8
SSDEEP 49152:9avY1Sn5eVNoAi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZVyrWsdGG:UY1a4JIig1VwkNU/mIzb4bpG
TLSH
T1A1C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-11_12cbc2e337a79641c6f5341aa954156e_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 9127fa31f9e18d479dceff38f99eda6837f60d40678eb731b84428d123e354cb
- MD5 12cbc2e337a79641c6f5341aa954156e
- SHA1 5d12bab78457be8bfba1222170b1e82cc699c5de
- SHA512 f954609bc382a65490fcb8d977f9966491da1ce3908cf16f33b077803cdc4fe570befeb2618cd1e8b1f0851baea18c4e3858d9b0b0d96415c95402491085fda8
- SSDEEP 49152:9avY1Sn5eVNoAi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZVyrWsdGG:UY1a4JIig1VwkNU/mIzb4bpG
- TLSH
  T1A1C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2