2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer
Size 6.1MB
Sample260717-vmt6fab16x
SHA256 8f3639561c60efb376d1939536c62b2b56dec03edd4189ea844c4dc9a4cda763
MD5 50c2f7f796235599ba026c96cc3c9171
SHA1 6cf87272a6583cb2640ebda84e03095f582173d1
SHA512 6ffba6a70b195438549eb36d9bcdd086099e4ea4de267e22a6a1e440f53984d10e82c56a41a36f686447994a5fd51db37f46d0764631c256b11f40a7daee0c47
SSDEEP 49152:Fv4Pf5rdH/yEmm64ZA5xRnz9Fu6k8TtkVdmqn1EtwcPgPfxqSHNN0CGeF6E0osTg:MwkM4J3H3Yj2aMK9SPn0yU023W
TLSH
T11B5629167AABA8ECC199C874834A4A731E2170DB1727B9FF41C485353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer

.exe 6.1MB

2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer

IMPHASH 01bcc0490bcf8aa910c6f74011677d48
SHA256 8f3639561c60efb376d1939536c62b2b56dec03edd4189ea844c4dc9a4cda763
MD5 50c2f7f796235599ba026c96cc3c9171
SHA1 6cf87272a6583cb2640ebda84e03095f582173d1
SHA512 6ffba6a70b195438549eb36d9bcdd086099e4ea4de267e22a6a1e440f53984d10e82c56a41a36f686447994a5fd51db37f46d0764631c256b11f40a7daee0c47
SSDEEP 49152:Fv4Pf5rdH/yEmm64ZA5xRnz9Fu6k8TtkVdmqn1EtwcPgPfxqSHNN0CGeF6E0osTg:MwkM4J3H3Yj2aMK9SPn0yU023W
TLSH
T11B5629167AABA8ECC199C874834A4A731E2170DB1727B9FF41C485353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pet.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

GetLastError CloseHandle GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx SetFilePointerEx SetFileInformationByHandle SwitchToThread FindNextFileW GetCommandLineW AddVectoredExceptionHandler FindClose GetCurrentThread GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo WaitForSingleObject QueryPerformanceFrequency GetLongPathNameW HeapFree GetProcessHeap QueryPerformanceCounter SetThreadStackGuarantee GetSystemInfo RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW ReleaseMutex HeapReAlloc RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA GetModuleHandleW FormatMessageW GetModuleFileNameW GetFileInformationByHandle HeapSize GetFullPathNameW CreateFileW CreateDirectoryW FindFirstFileExW ReadConsoleW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateNamedPipeW CreateThread ReadFileEx WriteFileEx SleepEx WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CreateEventW CancelIo ReadFile ExitProcess HeapAlloc DeleteFileW GetFinalPathNameByHandleW GetFileType LCMapStringW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetModuleHandleExW GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtReadFile

advapi32

RegEnumKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

advapi32

generic