2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer
Size 7.5MB
Sample260719-2dtxmsgz6v
SHA256 67c8c096fd33e16f942bfd919dd62f94e58484350b529daa9dd73a9274d10b83
MD5 5ffd35229b0c4c823d33610773f0e320
SHA1 209a769e4bb40da922057f2b6da61b4a6ed6c9d9
SHA512 32669686d3fe7fab5c79cbd8c02b758ba04f01fd8c8f13d0c96e35d4f44a155c7dcfbb8bb104357413131f5c63a8755579e1d4beb1d0a9fcb86cee90e8847c89
SSDEEP 98304:1trDYfGPvVxjMQ+t6qiCPLpeXyJ189/1k+sc5XLy:1Fxf8PDH+F
TLSH
T1398639217A9A98ADD49AC47483468A725A3130CB0B35B9FF44D492793F79EF41F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer

.exe 7.5MB

2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer

IMPHASH ba7b3010b5a5d2adaef150c7cd586255
SHA256 67c8c096fd33e16f942bfd919dd62f94e58484350b529daa9dd73a9274d10b83
MD5 5ffd35229b0c4c823d33610773f0e320
SHA1 209a769e4bb40da922057f2b6da61b4a6ed6c9d9
SHA512 32669686d3fe7fab5c79cbd8c02b758ba04f01fd8c8f13d0c96e35d4f44a155c7dcfbb8bb104357413131f5c63a8755579e1d4beb1d0a9fcb86cee90e8847c89
SSDEEP 98304:1trDYfGPvVxjMQ+t6qiCPLpeXyJ189/1k+sc5XLy:1Fxf8PDH+F
TLSH
T1398639217A9A98ADD49AC47483468A725A3130CB0B35B9FF44D492793F79EF41F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5261836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

valthrun_loader.pdb

bcryptprimitives

ProcessPrng

kernel32

EncodePointer CloseHandle LocalFree DuplicateHandle GetTickCount64 GetVersionExA GetSystemFirmwareTable GetLastError GetProcessHeap HeapFree LoadLibraryExA SetStdHandle FormatMessageW FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleTextAttribute ReadConsoleInputW GetNumberOfConsoleInputEvents FreeLibrary GetSystemTimeAsFileTime GetConsoleMode GetStdHandle WriteConsoleW HeapAlloc SetConsoleCursorInfo SetConsoleCursorPosition GetConsoleScreenBufferInfo GetConsoleProcessList SetConsoleMode InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualProtect RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead FindNextFileW GetTempPathW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar GetFinalPathNameByHandleW CompareStringW LCMapStringW HeapSize SetEnvironmentVariableW GetModuleFileNameW GetCommandLineW WaitForSingleObject DeleteFileW CreateProcessA ExitProcess CreateFileW GetCurrentProcess SetFileAttributesW MoveFileExW WaitForMultipleObjects RtlVirtualUnwind QueryPerformanceCounter GetModuleHandleW GetProcAddress RegisterWaitForSingleObject UnregisterWaitEx SetHandleInformation PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx WriteFile SetFileCompletionNotificationModes Sleep GetModuleHandleA CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency CreateThread GetCurrentProcessId ReadFileEx FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW CopyFileExW FindFirstFileExW FindClose GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex

oleaut32

SysStringLen SysFreeString

advapi32

RegOpenKeyExW RegOpenKeyTransactedW OpenSCManagerA RegCreateKeyExW RegCreateKeyTransactedW RegSetValueExW QueryServiceStatus OpenServiceA RegCloseKey RegQueryValueExW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

secur32

FreeCredentialsHandle AcquireCredentialsHandleA DeleteSecurityContext QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer InitializeSecurityContextW ApplyControlToken AcceptSecurityContext

user32

GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow ToUnicodeEx

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW

ws2_32

select getaddrinfo WSAGetLastError freeaddrinfo WSAIoctl setsockopt shutdown bind WSAStartup WSACleanup closesocket getpeername WSASocketW send recv connect ioctlsocket WSASend getsockopt getsockname

crypt32

CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_5ffd35229b0c4c823d33610773f0e320_akira_glassworm_icedid_rusty-stealer

bcryptprimitives

kernel32

oleaut32

advapi32

api-ms-win-core-synch-l1-2-0

secur32

user32

bcrypt

shell32

ws2_32

crypt32

ntdll

generic