2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer
Size 3.9MB
Sample260720-bqsbgabs9p
SHA256 3d50a8ee51de74a6e886194fdb5bed65152e1034c888f86961867da383c29ac3
MD5 6a998b4ed50780686e6b3b1ea3b39fee
SHA1 46e6561e6f128bd2de0ed5dd2a8b113b4d7d492e
SHA512 e47aa5726ea8fb4714a4d1f2dd52322928c00ccb0a4d1ca96a1783e9285d88a7e65120279cc487c6a16cdac2d0b949d43ca1ce9afd7914d5fb845cf4905d66e7
SSDEEP 49152:m9yR05awhqDSc4g90QmN7bnLULWsDBiAr+DxOC8MHcgYZta0XfQQlq/tykbbzqMf:mJhKbaDpX1ClQPBPFvtYsrVnN
TLSH
T1D3167C43FA9581E9C09EC178C72B9233EB72BC8D4620B79B27D44A612F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer

File Explorer

2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer

.exe 3.9MB

2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer

IMPHASH a3f24c4b39aa52b86733e0f35ecb81e3
SHA256 3d50a8ee51de74a6e886194fdb5bed65152e1034c888f86961867da383c29ac3
MD5 6a998b4ed50780686e6b3b1ea3b39fee
SHA1 46e6561e6f128bd2de0ed5dd2a8b113b4d7d492e
SHA512 e47aa5726ea8fb4714a4d1f2dd52322928c00ccb0a4d1ca96a1783e9285d88a7e65120279cc487c6a16cdac2d0b949d43ca1ce9afd7914d5fb845cf4905d66e7
SSDEEP 49152:m9yR05awhqDSc4g90QmN7bnLULWsDBiAr+DxOC8MHcgYZta0XfQQlq/tykbbzqMf:mJhKbaDpX1ClQPBPFvtYsrVnN
TLSH
T1D3167C43FA9581E9C09EC178C72B9233EB72BC8D4620B79B27D44A612F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2852040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kapubstealer.pdb

crypt32

CryptUnprotectData CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertOpenStore CertDuplicateStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore

kernel32

CloseHandle FindClose GetFileInformationByHandleEx GetLastError SetFileInformationByHandle SwitchToThread OpenProcess Process32Next Process32First SetFileAttributesW GetCurrentProcess GetSystemInfo GetModuleHandleW GetProcAddress CreateMutexW IsDebuggerPresent GetCurrentProcessId GlobalMemoryStatusEx GetTickCount64 GlobalLock GlobalUnlock GlobalSize LocalFree GetConsoleWindow CreateToolhelp32Snapshot AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetTimeZoneInformationForYear GetProcessHeap HeapFree HeapReAlloc SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFileInformationByHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep SetFilePointerEx FindNextFileW PostQueuedCompletionStatus LoadLibraryExA InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile FlushFileBuffers HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection MapViewOfFile GetTickCount CreateFileMappingW HeapDestroy

ntdll

NtQueryInformationProcess NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile NtDeviceIoControlFile

ws2_32

ioctlsocket WSASocketW WSASend shutdown getsockopt bind WSAStartup WSACleanup freeaddrinfo recv setsockopt getaddrinfo WSAIoctl getsockname getpeername closesocket WSAGetLastError connect send

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

GetTokenInformation AdjustTokenPrivileges DuplicateTokenEx RegOpenKeyExW RevertToSelf LookupPrivilegeValueA OpenProcessToken SetThreadToken RegEnumValueW RegEnumKeyExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey

secur32

QueryContextAttributesW AcquireCredentialsHandleA DeleteSecurityContext ApplyControlToken DecryptMessage InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer FreeCredentialsHandle EncryptMessage

bcryptprimitives

ProcessPrng

oleaut32

SysStringLen SysFreeString GetErrorInfo VariantClear SysAllocStringLen

user32

MessageBoxW GetCursorPos ShowWindow GetWindowLongPtrW SetWindowLongPtrW SendMessageTimeoutW CloseClipboard GetSystemMetrics GetClipboardData GetDesktopWindow GetWindowDC ReleaseDC OpenClipboard EnumClipboardFormats SetWindowPos

ole32

CoInitializeEx CoCreateInstance CoUninitialize

gdi32

DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC GetDIBits

vcruntime140

memmove __current_exception_context memset __CxxFrameHandler3 __current_exception memcmp memchr strchr strrchr memcpy __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen strcmp strcspn strncmp strspn

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass log fabs __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _initialize_onexit_table __p___argv _get_initial_narrow_environment __p___argc _initialize_narrow_environment _crt_atexit terminate _cexit _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _endthreadex _beginthreadex _register_onexit_function _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer

crypt32

kernel32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

advapi32

ncrypt

secur32

bcryptprimitives

oleaut32

user32

ole32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic