Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe
- Size 1.3MB
- Sample260730-v7wvrsda82
- SHA256 e59f03a458a033a34b4cf44c8332d2b678e28994d0a39de7d6924c1bf9b0fe25
- MD5 5d4bd2c622157f6722780d058e449d04
- SHA1 f869b428fe3b5dcc291a9a61641f17386e65cc70
- SHA512 7b585e004e990379420e3cc16f2479c7d32565c03ea926ed0376eac17ac278b0a9528d947405670bce0fefb5e1855df1d0c0ca799bae85528cc73c8c3a381f05
- SSDEEP 24576:Tndj4Zn7P5TLkrOISA5pM4YZeT7aR2uhaxV:bdjmRTgrOISMpZ/T7C0
- TLSH T1C7556C56FA5691ECC569C0B4C3459A33BE72BC89073979FB0AE446313E65BD02B3CB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppUserModelId\FelipeSantos.VolumeLocker 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppUserModelId 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppUserModelId\FelipeSantos.VolumeLocker\DisplayName = "Volume Locker" 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppUserModelId\FelipeSantos.VolumeLocker\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VolumeLocker.png" 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4136 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe 4136 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4136 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe 4136 2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5d4bd2c622157f6722780d058e449d04_akira_glassworm_rusty-stealer.exe"1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4136