2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer
Size 809KB
Sample260721-zwpdrsthnd
SHA256 34a7c5b8cf169a8a45855501ae80070cfeb286111c2c6942e9b5735b7332c795
MD5 31fa152f22ddf2f625d434fdefe5403c
SHA1 24a62ed761986c387597c4d32b5172f81e103202
SHA512 4ab0d317fdda3cb2cbd28003079fb743612d04c6685be3e44a97b061a72c25ae631faefe6cd2498bb2cee3ccdb3b1b6b5f0745046587b2ed55cb280d4d6424ca
SSDEEP 12288:XUs8a8yMoCtZehJcms9mjF9T7e/yFKJGwI6j7HYwYVgzaOr:XZAZehJpsMF9T7e/yoJGK7o
TLSH
T1A1050821BA565AAED056C474C3464AB26A3134CF1B31A9FF00ED61783F6DAF61F3D218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer

File Explorer

2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer

.exe 809KB

2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer

IMPHASH 59a91b758bb7957474fac93e92926a68
SHA256 34a7c5b8cf169a8a45855501ae80070cfeb286111c2c6942e9b5735b7332c795
MD5 31fa152f22ddf2f625d434fdefe5403c
SHA1 24a62ed761986c387597c4d32b5172f81e103202
SHA512 4ab0d317fdda3cb2cbd28003079fb743612d04c6685be3e44a97b061a72c25ae631faefe6cd2498bb2cee3ccdb3b1b6b5f0745046587b2ed55cb280d4d6424ca
SSDEEP 12288:XUs8a8yMoCtZehJcms9mjF9T7e/yFKJGwI6j7HYwYVgzaOr:XZAZehJpsMF9T7e/yoJGK7o
TLSH
T1A1050821BA565AAED056C474C3464AB26A3134CF1B31A9FF00ED61783F6DAF61F3D218
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pillowtome-70c9ef510bae4c1a.pdb

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile RtlNtStatusToDosError

kernel32

WaitForMultipleObjects InitializeSListHead GetFileAttributesW GetProcAddress GetCurrentThreadId CloseHandle GetLastError lstrlenW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetModuleHandleA ExitProcess FindClose FindFirstFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx IsProcessorFeaturePresent GetSystemTimeAsFileTime GetExitCodeProcess LoadLibraryA CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime GetProcessHeap HeapFree HeapAlloc FormatMessageW RtlVirtualUnwind RtlLookupFunctionEntry GetModuleHandleW GetSystemInfo IsDebuggerPresent GetFileInformationByHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleMode UnhandledExceptionFilter GetFileType GetStdHandle CompareStringOrdinal FreeEnvironmentStringsW RtlCaptureContext DuplicateHandle WaitForSingleObject GetCurrentProcess WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId CreateEventW CreateThread SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp __C_specific_handler __current_exception_context __current_exception __CxxFrameHandler3 memcpy memmove memset _CxxThrowException

api-ms-win-crt-math-l1-1-0

floor __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc _seh_filter_exe _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_31fa152f22ddf2f625d434fdefe5403c_akira_rusty-stealer

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic