91cf0dc9f091efc58d0ce63a4311d0adf87639c0271095b844171f7a2a7f090b

General

Target
2026-07-14_a652d746c06ba28d921b248a5a983fea_akira_glassworm_rusty-stealer
Size 2.5MB
Sample260715-asf6jsgv2k
SHA256 91cf0dc9f091efc58d0ce63a4311d0adf87639c0271095b844171f7a2a7f090b
MD5 a652d746c06ba28d921b248a5a983fea
SHA1 43cf765e5f06191ce4ebfed724a79fa91e1c968c
SHA512 619326546331eb763c7e4d001b571bf73ed682f5270f2d306c36c8b993c3dd7407da49a28e5b3018a70f00a41d0b44eea153b1f079a3c6f27e25a5561cbc388a
SSDEEP 49152:davY1Sn5eVNoWi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZpyRWsdGN:0Y1aOJIig1VwkNU/mIzb4bpY
TLSH
T1FAC59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-14_a652d746c06ba28d921b248a5a983fea_akira_glassworm_rusty-stealer
- Size 2.5MB
- SHA256 91cf0dc9f091efc58d0ce63a4311d0adf87639c0271095b844171f7a2a7f090b
- MD5 a652d746c06ba28d921b248a5a983fea
- SHA1 43cf765e5f06191ce4ebfed724a79fa91e1c968c
- SHA512 619326546331eb763c7e4d001b571bf73ed682f5270f2d306c36c8b993c3dd7407da49a28e5b3018a70f00a41d0b44eea153b1f079a3c6f27e25a5561cbc388a
- SSDEEP 49152:davY1Sn5eVNoWi3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZpyRWsdGN:0Y1aOJIig1VwkNU/mIzb4bpY
- TLSH
  T1FAC59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables referencing many IR and analysis tools
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2