42b0d82f52d606888d9f8173d34444b7ffc542cf88da3850b2c4ec1906cc1728

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
Size 2.9MB
Sample260727-n63hlaej2x
SHA256 42b0d82f52d606888d9f8173d34444b7ffc542cf88da3850b2c4ec1906cc1728
MD5 e75e6d324a84ae1e691f3078d77e8edd
SHA1 c2bcce7f6e248ad2a12055c8ac94044504528abe
SHA512 cd0e71e7c0aa085e4032ff7335a91ecd4d0a49bded36f39ba2d501682ab72d6049305f748cd7c7c3954a3de9b5f3bb45513fcde26cd53ebfdbe6f909c83ba0f6
SSDEEP 49152:O/JJwpFZV00Pw7hWHAqZJjxCkB/Vf5Ug1wmTVapvCANhYiLLQDyG18BA:OB+9j/91v9N+Gu
TLSH
T15DD57C43F69945E9D4AEC138834A9372A735F8484932BB5B37ACC7122F25F606F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Looks for VirtualBox drivers on disk 2 TTPs 2 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe

Looks for VMWare drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1928	4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe	89
PID 4416 wrote to memory of 1928	4416	2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e75e6d324a84ae1e691f3078d77e8edd_akira_glassworm_rusty-stealer.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4416"
  2⤵
  PID:1928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\hack-browser-data-rs-results\Chrome\Profile 1 (Default)\cookies.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\hack-browser-data-rs-results\Chrome\Profile 1 (Default)\cookies.txt
Size 60B
SHA256 2b0cb79721d8ae21bd108d2f5756e2e438a0ea65716f865b6d3b9c9b176b23c5
MD5 26c9b8de0388caf4e6f551a8d0c93334
SHA1 203bea023747f12ea111f363f397551f5197029f
SHA512 af77be38338516a06faa2d0c220a7e44a62396d7504541cd23e6a2c9c4b4bab0b7e1055824237446b3d4a64c14a09bd42eb3977473a43ff1312869cbb1416c84
TLSH
T15AA002271183C168095F92415751CFB104D73D475B986A60850946EED52CC5529EC9A9
MD5 SHA1 SHA512 TLSH

Submit Download