2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer
Size 11.3MB
Sample260720-wtk2sacv8t
SHA256 18b3743532632369a9cd6f51127b69bf67aa625d1b5718621e8f7d2010b1d3b7
MD5 07822bf98f054319ebd739006753c537
SHA1 2027f312de543623d56acd3d973680629b0f22fa
SHA512 5df52427479d77faf3cb0c9feaaa2e73610efdad069ccf371dfbf344626579c93482941818c3e5851a966f784ba42b5047b1975a3be3183f2f1450984a060152
SSDEEP 98304:agXL9/ZBUSvc0CVoUZA/Q4iFStdO2HdD36ilm:agXHBUSkVoPi6O2
TLSH
T15EC6E717E77960E9D5BFC07892939B22BD20749907392BF74980826A1F20FF8AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer

File Explorer

2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer

.exe 11.3MB

2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer

IMPHASH 82a391d4cd1eaa6481bb69a1cb364479
SHA256 18b3743532632369a9cd6f51127b69bf67aa625d1b5718621e8f7d2010b1d3b7
MD5 07822bf98f054319ebd739006753c537
SHA1 2027f312de543623d56acd3d973680629b0f22fa
SHA512 5df52427479d77faf3cb0c9feaaa2e73610efdad069ccf371dfbf344626579c93482941818c3e5851a966f784ba42b5047b1975a3be3183f2f1450984a060152
SSDEEP 98304:agXL9/ZBUSvc0CVoUZA/Q4iFStdO2HdD36ilm:agXHBUSkVoPi6O2
TLSH
T15EC6E717E77960E9D5BFC07892939B22BD20749907392BF74980826A1F20FF8AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8361308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rust_rat_full_2026.pdb

user32

MessageBoxW GetAsyncKeyState GetKeyState GetForegroundWindow GetWindowTextW EnumDisplaySettingsExW EnumDisplayMonitors GetMonitorInfoW

crypt32

CryptUnprotectData CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateStore CertEnumCertificatesInStore CertOpenStore CertCloseStore CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext

secur32

EncryptMessage DeleteSecurityContext AcquireCredentialsHandleA QueryContextAttributesW ApplyControlToken FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer DecryptMessage LsaGetLogonSessionData LsaFreeReturnBuffer LsaEnumerateLogonSessions

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation LookupAccountSidW IsValidSid GetUserNameW GetLengthSid CopySid

kernel32

GlobalMemoryStatusEx GetExitCodeProcess GetCurrentProcessId GetSystemInfo GetDriveTypeW GetVolumeInformationW DeviceIoControl GetLastError LoadLibraryExA WaitForSingleObject HeapFree CreateFileW HeapAlloc GetProcessHeap CreateEventW FormatMessageW GetDiskFreeSpaceExW GetLogicalDrives OpenProcess GetTimeZoneInformationForYear SetFileCompletionNotificationModes VirtualQueryEx ReadProcessMemory GetProcessTimes GetSystemTimes GetProcessIoCounters WriteFile GetOverlappedResult ReadFile CloseHandle GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort SetHandleInformation GetModuleHandleW GetProcAddress FlushFileBuffers GetTickCount QueryPerformanceCounter FreeLibrary CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetFileSize LockFileEx MapViewOfFile HeapDestroy HeapCompact LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId CompareStringOrdinal FreeEnvironmentStringsW GetComputerNameExW WriteFileEx SleepEx SetLastError LocalFree SetFileInformationByHandle SetFileTime QueryPerformanceFrequency CreateThread GetTickCount64 ReadFileEx GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime UnlockFile CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetEnvironmentStringsW GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW FindFirstFileExW FindClose SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW FindNextFileW GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetModuleHandleA WaitForMultipleObjects IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

closesocket shutdown connect WSASocketW send WSAGetLastError bind WSAIoctl WSASend ioctlsocket getsockname getpeername setsockopt getsockopt getaddrinfo WSAStartup recv freeaddrinfo WSACleanup

ntdll

RtlGetVersion NtQueryInformationProcess NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtOpenFile NtQuerySystemInformation NtCreateFile NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile

bcryptprimitives

ProcessPrng

gdi32

CreateDCW GetDIBits DeleteDC CreateCompatibleBitmap CreateCompatibleDC SetStretchBltMode SelectObject DeleteObject StretchBlt GetObjectW GetDeviceCaps

oleaut32

SysStringLen VariantClear SysAllocString SysFreeString GetErrorInfo

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses FreeMibTable GetIfTable2 GetIfEntry2

psapi

GetModuleFileNameExW GetPerformanceInfo

pdh

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhCollectQueryData PdhOpenQueryA

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW

netapi32

NetApiBufferFree NetUserEnum NetUserGetInfo NetUserGetLocalGroups

vcruntime140

memcmp memmove strrchr _CxxThrowException __C_specific_handler __current_exception memcpy __current_exception_context memset __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

round log roundf _dclass cosf logf powf __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strlen strcmp strcspn strncmp

api-ms-win-crt-heap-l1-1-0

realloc free _msize malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _beginthreadex __p___argv _endthreadex exit _initterm_e _initterm _seh_filter_exe _initialize_narrow_environment _cexit _configure_narrow_argv _set_app_type _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_07822bf98f054319ebd739006753c537_akira_glassworm_rusty-stealer

user32

crypt32

secur32

advapi32

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

gdi32

oleaut32

ole32

iphlpapi

psapi

pdh

powrprof

shell32

netapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic