2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer
Size 3.9MB
Sample260719-mdbczaby4x
SHA256 408334f4b30fa4b88511c9d70cad56f40d13d20843984ce547282d2e0bc8c189
MD5 e84e7010838bf6044648a6504ee50a25
SHA1 254117355b2deab7ed04d3bf41873a19887a740d
SHA512 e555af2a2ffbaaa680a06779872c26a7cd0dedb782d6605f9f03993e9bd5cd60f15b73890a7ebe42ef81993e1652961e8adb6ecc5647611a8f949189f097daad
SSDEEP 49152:tt//RPZHHnAS+pFzVH/sfVzeqRqYeW+BvS1ZySAwztgrJqa0XfQuKgsv6PzLKNqQ:tz/JIMpJKnyqVCvsLCPW8xE
TLSH
T1F3167C43FA9581E9C09EC178C72B9233EB72BC8D4620B79B27D45A212F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer

File Explorer

2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer

.exe 3.9MB

2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer

IMPHASH 4544c1cc40d23efe85146da51824c03e
SHA256 408334f4b30fa4b88511c9d70cad56f40d13d20843984ce547282d2e0bc8c189
MD5 e84e7010838bf6044648a6504ee50a25
SHA1 254117355b2deab7ed04d3bf41873a19887a740d
SHA512 e555af2a2ffbaaa680a06779872c26a7cd0dedb782d6605f9f03993e9bd5cd60f15b73890a7ebe42ef81993e1652961e8adb6ecc5647611a8f949189f097daad
SSDEEP 49152:tt//RPZHHnAS+pFzVH/sfVzeqRqYeW+BvS1ZySAwztgrJqa0XfQuKgsv6PzLKNqQ:tz/JIMpJKnyqVCvsLCPW8xE
TLSH
T1F3167C43FA9581E9C09EC178C72B9233EB72BC8D4620B79B27D45A212F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2852008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kapubstealer.pdb

crypt32

CryptUnprotectData CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertOpenStore CertDuplicateStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore

kernel32

CloseHandle FindClose GetFileInformationByHandleEx GetLastError SetFileInformationByHandle SwitchToThread OpenProcess Process32Next Process32First SetFileAttributesW GetCurrentProcess GetSystemInfo GetModuleHandleW GetProcAddress CreateMutexW IsDebuggerPresent GetCurrentProcessId GlobalMemoryStatusEx GetTickCount64 GlobalLock GlobalUnlock GlobalSize LocalFree GetConsoleWindow CreateToolhelp32Snapshot AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetTimeZoneInformationForYear SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFileInformationByHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep SetFilePointerEx FindNextFileW PostQueuedCompletionStatus LoadLibraryExA InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile FlushFileBuffers HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection MapViewOfFile GetTickCount CreateFileMappingW HeapDestroy

ntdll

NtQueryInformationProcess NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile NtDeviceIoControlFile

ws2_32

ioctlsocket WSASocketW WSASend shutdown getsockopt bind WSAStartup WSACleanup freeaddrinfo recv setsockopt getaddrinfo WSAIoctl getsockname getpeername closesocket WSAGetLastError connect send

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

GetTokenInformation AdjustTokenPrivileges DuplicateTokenEx RegOpenKeyExW RevertToSelf LookupPrivilegeValueA OpenProcessToken SetThreadToken RegEnumValueW RegEnumKeyExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey

secur32

QueryContextAttributesW AcquireCredentialsHandleA DeleteSecurityContext ApplyControlToken DecryptMessage InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer FreeCredentialsHandle EncryptMessage

bcryptprimitives

ProcessPrng

oleaut32

SysStringLen SysFreeString GetErrorInfo VariantClear SysAllocStringLen

user32

MessageBoxW GetCursorPos ShowWindow GetWindowLongPtrW SetWindowLongPtrW SendMessageTimeoutW CloseClipboard GetSystemMetrics GetClipboardData GetDesktopWindow GetWindowDC ReleaseDC OpenClipboard EnumClipboardFormats SetWindowPos

ole32

CoInitializeEx CoCreateInstance CoUninitialize

gdi32

DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC GetDIBits

vcruntime140

memmove __current_exception_context memset __CxxFrameHandler3 __current_exception memcmp memchr strchr strrchr memcpy __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen strcmp strcspn strncmp strspn

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass log fabs __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _initialize_onexit_table __p___argv _get_initial_narrow_environment __p___argc _initialize_narrow_environment _crt_atexit terminate _cexit _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _endthreadex _beginthreadex _register_onexit_function _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer

crypt32

kernel32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

advapi32

ncrypt

secur32

bcryptprimitives

oleaut32

user32

ole32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic