2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer
Size 301KB
Sample260714-db3vrse12w
SHA256 9c39677bda7255b7823acdd35e1d6b3a72cd24499cce38a927ba32a9f368e496
MD5 e40748eaea6d12d02320b53b2fa5f63d
SHA1 3109e32e9b2f1b23688d73c0ee6268e1a0cf1f22
SHA512 3cccdd3fe555a0b51df1600c9d4f167085fb5f1986ec46f9f28da03057f01a1899a7d2dfe2381f7b4e58fb29ea6805c88f07e5e501593c1078301626c5575d39
SSDEEP 3072:jjHA4dmFrPTidoA77sUowW86w5IXFH1My4tvZiyKK8YpqDdMlr5Ki2gRg3BrWTVb:HeFrPTiXjzWZw5MJaj8Y7UIG1jo/
TLSH
T160646B13F29448F8D49AC0B4835A89636A7278CA1B31B5FF17D44A243E5AFE16F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer

File Explorer

2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer

.exe 301KB

2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer

IMPHASH f61512c32c4a28ed0f53a0afced89964
SHA256 9c39677bda7255b7823acdd35e1d6b3a72cd24499cce38a927ba32a9f368e496
MD5 e40748eaea6d12d02320b53b2fa5f63d
SHA1 3109e32e9b2f1b23688d73c0ee6268e1a0cf1f22
SHA512 3cccdd3fe555a0b51df1600c9d4f167085fb5f1986ec46f9f28da03057f01a1899a7d2dfe2381f7b4e58fb29ea6805c88f07e5e501593c1078301626c5575d39
SSDEEP 3072:jjHA4dmFrPTidoA77sUowW86w5IXFH1My4tvZiyKK8YpqDdMlr5Ki2gRg3BrWTVb:HeFrPTiXjzWZw5MJaj8Y7UIG1jo/
TLSH
T160646B13F29448F8D49AC0B4835A89636A7278CA1B31B5FF17D44A243E5AFE16F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

228660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

RegOpenKeyExW FreeSid CheckTokenMembership OpenProcessToken AllocateAndInitializeSid RegQueryValueExW RegCloseKey RegEnumKeyExW SystemFunction036

kernel32

GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetTempPathW Sleep GetCommandLineW MoveFileExW GetLastError SetFileInformationByHandle CloseHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc CreateFileW GetCurrentProcess GetTickCount64 SetLastError GetVolumeInformationA Process32FirstW Process32NextW GetFileInformationByHandleEx SwitchToThread GetCurrentProcessId GetFinalPathNameByHandleW CopyFileExW FindClose SetHandleInformation FindNextFileW FindFirstFileExW GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter CreateThread GetModuleHandleA GetFullPathNameW SetFileTime GetFileInformationByHandle CreateDirectoryW ExitProcess GetModuleFileNameW IsProcessorFeaturePresent DeleteFileW CreateWaitableTimerExW SetWaitableTimer

ntdll

NtOpenFile RtlNtStatusToDosError NtWriteFile

psapi

GetModuleFileNameExW

shell32

SHGetFolderPathW

ws2_32

closesocket getaddrinfo freeaddrinfo connect setsockopt WSAStartup WSACleanup recv WSAGetLastError WSASocketW WSADuplicateSocketW send

vcruntime140

__C_specific_handler memset __current_exception_context memmove memcmp __CxxFrameHandler3 memcpy __current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe _initialize_narrow_environment _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _exit exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_e40748eaea6d12d02320b53b2fa5f63d_akira_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

psapi

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic