2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer
Size 5.9MB
Sample260722-vaxe2aygme
SHA256 155433e59feefc2e947aba862e355d9282f72c362c907facd39082ec0340260d
MD5 eea41838f23c9106cf558b21c2f71896
SHA1 025d58c0f1e056a239e899cf83ec8d0243c7a70d
SHA512 54dc9012c89e42b7449e19e51c494c71facf1b2b002e278cde5551e709e9963de8a475f235c7ddc570d445e82e5d055392267a59031c3239f540c395e1b73b11
SSDEEP 98304:vCq40eVYqOr+FNb8dE8xOngOqBmDXtd2CNDU:vZ4KDdlxWhDXP2C5
TLSH
T1855629117AABA8ECC199C8B5834A46731E2174CB1B36B9FF44C446353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer

File Explorer

2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer

.exe 5.9MB

2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer

IMPHASH cb32a0b8fc2de6e122e44d7c2d57b270
SHA256 155433e59feefc2e947aba862e355d9282f72c362c907facd39082ec0340260d
MD5 eea41838f23c9106cf558b21c2f71896
SHA1 025d58c0f1e056a239e899cf83ec8d0243c7a70d
SHA512 54dc9012c89e42b7449e19e51c494c71facf1b2b002e278cde5551e709e9963de8a475f235c7ddc570d445e82e5d055392267a59031c3239f540c395e1b73b11
SSDEEP 98304:vCq40eVYqOr+FNb8dE8xOngOqBmDXtd2CNDU:vZ4KDdlxWhDXP2C5
TLSH
T1855629117AABA8ECC199C8B5834A46731E2174CB1B36B9FF44C446353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4092784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pet.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

WriteConsoleW GetEnvironmentVariableW GetModuleHandleA GetModuleHandleW FormatMessageW GetModuleFileNameW GetFileInformationByHandle GetCurrentThreadId GetFullPathNameW CreateFileW CreateDirectoryW FindFirstFileExW ReadConsoleW CompareStringOrdinal SwitchToThread GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateNamedPipeW CreateThread ReadFileEx WriteFileEx GetConsoleOutputCP WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CreateEventW CancelIo ReadFile ExitProcess MultiByteToWideChar DeleteFileW GetFinalPathNameByHandleW GetFileType IsProcessorFeaturePresent TerminateProcess InitializeSListHead SetFileInformationByHandle IsDebuggerPresent GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime FindClose CloseHandle GetLastError QueryPerformanceCounter HeapReAlloc HeapFree GetProcessHeap GetCurrentDirectoryW SetLastError RtlVirtualUnwind WideCharToMultiByte ReleaseMutex lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx CreateMutexA GetCurrentProcessId RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetSystemInfo FindNextFileW GetCommandLineW HeapAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetLongPathNameW QueryPerformanceFrequency WaitForSingleObject GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetSystemTimeAsFileTime GetConsoleMode GetStdHandle SleepEx GetCurrentThread GetSystemDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtReadFile

advapi32

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegQueryValueExW

vcruntime140

_CxxThrowException memmove memset __C_specific_handler __CxxFrameHandler3 memcpy __current_exception_context __current_exception memcmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic