2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer
Size 1.0MB
Sample260731-d6cl3avyes
SHA256 f1d5b711619f1b2c458883766a957e9794cd6ceb880964a630b60727e3b60bbb
MD5 02f574793004b4cd9447a6bfe7ac129b
SHA1 edda0f46b4741b9c375c0c78154864ad11bbf917
SHA512 2dbd9c137b59ec37ae2a34ed6d77172125eb1b7404087fad8fdf505efa4aea661b98b8f3f1f3ae3d95cc6c22f124f6b2b5f9fcb37911327c35bf98e610b22beb
SSDEEP 12288:U+vxKsQGOONL1MC4m5YCFizQQCOAOqovTJHkCNd:U+pKsFOUH5YCFYi/Oq8t
TLSH
T10F254A03A69985EAC54DC07CC7579132BA32B88D0B34B6EF6B942B393E27F905B1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer

File Explorer

2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer

.exe 1.0MB

2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer

IMPHASH 7b0a08d5ee8ac06b82386aa66a73fbcd
SHA256 f1d5b711619f1b2c458883766a957e9794cd6ceb880964a630b60727e3b60bbb
MD5 02f574793004b4cd9447a6bfe7ac129b
SHA1 edda0f46b4741b9c375c0c78154864ad11bbf917
SHA512 2dbd9c137b59ec37ae2a34ed6d77172125eb1b7404087fad8fdf505efa4aea661b98b8f3f1f3ae3d95cc6c22f124f6b2b5f9fcb37911327c35bf98e610b22beb
SSDEEP 12288:U+vxKsQGOONL1MC4m5YCFizQQCOAOqovTJHkCNd:U+pKsFOUH5YCFYi/Oq8t
TLSH
T10F254A03A69985EAC54DC07CC7579132BA32B88D0B34B6EF6B942B393E27F905B1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

635132

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

de_anti.pdb

kernel32

ReleaseMutex GetCurrentProcessId WaitForSingleObject HeapAlloc WaitForSingleObjectEx GetCurrentProcess GetCurrentThreadId SetHandleInformation GetProcAddress GetModuleHandleA GetFullPathNameW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess GetModuleHandleW SetUnhandledExceptionFilter SetFileCompletionNotificationModes PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError CloseHandle GetSystemTimeAsFileTime CreateMutexA CreateThread AddVectoredExceptionHandler IsProcessorFeaturePresent InitializeSListHead GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter IsDebuggerPresent UnhandledExceptionFilter SwitchToThread HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee FindFirstFileExW GetLastError FindClose LoadLibraryA FindNextFileW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSASend shutdown ioctlsocket closesocket setsockopt connect getsockopt bind WSAStartup WSACleanup freeaddrinfo WSAIoctl recv send getpeername WSASocketW getsockname WSAGetLastError getaddrinfo

ntdll

RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile

crypt32

CertCloseStore CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertAddCertificateContextToStore CertEnumCertificatesInStore CertGetCertificateChain CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertDuplicateStore CertDuplicateCertificateChain

secur32

FreeContextBuffer EncryptMessage DeleteSecurityContext AcceptSecurityContext AcquireCredentialsHandleA QueryContextAttributesW InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memset memmove __CxxFrameHandler3 memcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _initterm _seh_filter_exe __p___argc _exit exit __p___argv _set_app_type terminate _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_02f574793004b4cd9447a6bfe7ac129b_akira_glassworm_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

secur32

bcryptprimitives

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic