2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer
Size 110.0MB
Sample260722-2dwq8saj21
SHA256 2ae0d2b14e49454e898c1e4bf003ee1059ff8310688d69453442448913067e1e
MD5 163bb29daa8b480b4d5bf402c96d49a1
SHA1 40e2e4c3d259f573c81fc7bc735276abc098ef19
SHA512 e81c2e066f7eb8ba7faf122f686c4205c017d4d9d660f6c54d06450739c02314b950c797c0a5f11affd88c02cdbe9686bcbb82c97ba9c47b22309378952d7950
SSDEEP 6144:vMXQc06yWyR+5xbHT3R+y2c8rDSfxW8Y8ltpiMsPYo3K3psLKfYuYV0k:IrLZ2c66xRYY2ks9uYVL
TLSH
T1254877BCA1C87090D55ED3B1DBE4EDBE632316EA11534D4C0668AAD12A437AFFB148CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer

File Explorer

2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer

.exe 110.0MB

2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer

IMPHASH 8af55ddd58c9683c90534e7f8d1e7f5c
SHA256 2ae0d2b14e49454e898c1e4bf003ee1059ff8310688d69453442448913067e1e
MD5 163bb29daa8b480b4d5bf402c96d49a1
SHA1 40e2e4c3d259f573c81fc7bc735276abc098ef19
SHA512 e81c2e066f7eb8ba7faf122f686c4205c017d4d9d660f6c54d06450739c02314b950c797c0a5f11affd88c02cdbe9686bcbb82c97ba9c47b22309378952d7950
SSDEEP 6144:vMXQc06yWyR+5xbHT3R+y2c8rDSfxW8Y8ltpiMsPYo3K3psLKfYuYV0k:IrLZ2c66xRYY2ks9uYVL
TLSH
T1254877BCA1C87090D55ED3B1DBE4EDBE632316EA11534D4C0668AAD12A437AFFB148CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

40:2b:6c:fc:a9:3b:11:7f:b7:50:43:68:28:cc:48:bc:f0:90:22:da:86:ab:eb:ae:e3:5b:d2:3e:f5:78:31:1a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,OU=Windows Security,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 17, 2026

CN=Microsoft Windows,OU=Windows Security,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateDirectoryW CreateFileMappingA CreateFileW CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtWriteFile RtlNtStatusToDosError

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fflush fwrite

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

Name

.text

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_163bb29daa8b480b4d5bf402c96d49a1_akira_rusty-stealer

PE Signature issue

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

generic