2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer
Size 2.8MB
Sample260721-3pl7lsbj3x
SHA256 3e72297abd2f58155fb2062613414df43fe568b28345270fd9ace8db1f0cf742
MD5 f23d837c2da46a9258a541efc57e1b7f
SHA1 1a717f0d029df86b5e45cc24bd1765eab5971127
SHA512 51cd689a9ff2f76f32e398951de72fdfc9cba6dbd127f74482f1303ca9db91114400644471b6046d9ef962b5b53e07e3e6a8ad5986f19dce50e726760bca7fcf
SSDEEP 49152:Ry3dEmcgi7NL6qlEhs6iwOwTzpezjnPRo13D47GiCFp:Wi7IMEhsMTz8XPu3iCFp
TLSH
T10BD54B53FA6291E8C1A9C07483166233BB32BC4D47217BEB5BD44A313F65BA06E7CB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer

.exe 2.8MB

2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer

IMPHASH 17d8535a62a8f8a32a6b646c39bbfb45
SHA256 3e72297abd2f58155fb2062613414df43fe568b28345270fd9ace8db1f0cf742
MD5 f23d837c2da46a9258a541efc57e1b7f
SHA1 1a717f0d029df86b5e45cc24bd1765eab5971127
SHA512 51cd689a9ff2f76f32e398951de72fdfc9cba6dbd127f74482f1303ca9db91114400644471b6046d9ef962b5b53e07e3e6a8ad5986f19dce50e726760bca7fcf
SSDEEP 49152:Ry3dEmcgi7NL6qlEhs6iwOwTzpezjnPRo13D47GiCFp:Wi7IMEhsMTz8XPu3iCFp
TLSH
T10BD54B53FA6291E8C1A9C07483166233BB32BC4D47217BEB5BD44A313F65BA06E7CB45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1996380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hbbr.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleExW WriteFile FlushFileBuffers GetProcessHeap HeapFree GetLastError QueryPerformanceCounter PostQueuedCompletionStatus CloseHandle CreateFileW GetConsoleMode SetConsoleMode SetFilePointerEx SetEnvironmentVariableW GetSystemInfo HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetStdHandle GetFileInformationByHandleEx CreateWaitableTimerExW SetWaitableTimer Sleep WaitForSingleObject SwitchToThread DeleteFileW SetFileInformationByHandle GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear QueryPerformanceFrequency FindFirstFileExW FindClose FindNextFileW SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetModuleHandleA GetProcAddress SetHandleInformation GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetCommandLineW GetModuleFileNameW GetFileInformationByHandle GetFullPathNameW CreateDirectoryW ReadConsoleW CreateThread ExitProcess HeapAlloc MoveFileExW VirtualProtect InitializeCriticalSection EnterCriticalSection LeaveCriticalSection HeapSize LCMapStringW RtlPcToFileHeader CompareStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc LoadLibraryExW GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FreeLibrary UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx EncodePointer RaiseException DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA

ws2_32

freeaddrinfo getaddrinfo WSACleanup recv WSAIoctl send WSASend shutdown accept ioctlsocket WSASocketW closesocket WSAGetLastError setsockopt listen WSAStartup bind

ntdll

NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

700KB

Virtual Size

699KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_f23d837c2da46a9258a541efc57e1b7f_akira_glassworm_icedid_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

ntdll

bcrypt

advapi32

generic