2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer
Size 11.5MB
Sample260801-c9s8jsce35
SHA256 b93ee4d95954ab9c42efb69633f7f5eb42c0aba58ca795137a1b8617d7b65cf8
MD5 b066befac4390f0477249bccff84bc2b
SHA1 952d1773d2b840f9973a486c6d81bdb551001b9c
SHA512 71fea926b2fc26410ad6dc17af9b50db62164ca1268dd1b98e2b9aa72c8892a58ea7ff14ac7656f42ae1f919f9693319a0630825b87a4e7f3c00ed3117f44b02
SSDEEP 98304:IyE4MjdalU0EdZhINYDi/TUCSzAQdrUZ/qouGSi95:G0HUd4V
TLSH
T164C62812BBAA98ACD59AC474C3568A635A3134CE0B35B9FF45C482343F69AF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer

File Explorer

2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer

.exe 11.5MB

2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer

IMPHASH 6be252c9e8945c63a02f14d340274cfd
SHA256 b93ee4d95954ab9c42efb69633f7f5eb42c0aba58ca795137a1b8617d7b65cf8
MD5 b066befac4390f0477249bccff84bc2b
SHA1 952d1773d2b840f9973a486c6d81bdb551001b9c
SHA512 71fea926b2fc26410ad6dc17af9b50db62164ca1268dd1b98e2b9aa72c8892a58ea7ff14ac7656f42ae1f919f9693319a0630825b87a4e7f3c00ed3117f44b02
SSDEEP 98304:IyE4MjdalU0EdZhINYDi/TUCSzAQdrUZ/qouGSi95:G0HUd4V
TLSH
T164C62812BBAA98ACD59AC474C3568A635A3134CE0B35B9FF45C482343F69AF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8676300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wingw.pdb

bcryptprimitives

ProcessPrng

kernel32

SetHandleInformation PostQueuedCompletionStatus GetOverlappedResult ReadFile WriteFile CancelIoEx CreateIoCompletionPort RegisterWaitForSingleObject SetNamedPipeHandleState SetFileCompletionNotificationModes WaitForSingleObject DuplicateHandle Sleep GetModuleHandleA GetConsoleMode CreateFileW SetEvent SetFileAttributesW CreateEventA GetSystemTimes GetCurrentProcess CreateEventW WaitForMultipleObjectsEx SetThreadPriority GetDiskFreeSpaceExW GetCurrentThreadId GetProcAddress GlobalMemoryStatusEx GetTickCount64 FormatMessageW LoadLibraryExA GetLastError IsProcessorFeaturePresent GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap CloseHandle InitializeSListHead IsDebuggerPresent GetModuleHandleW GetQueuedCompletionStatusEx FindNextFileW GetTempPathW WaitForMultipleObjects GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW UnregisterWaitEx MultiByteToWideChar CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW MoveFileExW SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetModuleFileNameW GetCurrentProcessId ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW DeleteFileW CopyFileExW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW

advapi32

RegCloseKey RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW

oleaut32

SysStringLen SysFreeString GetErrorInfo

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASend recv getpeername listen accept getsockname send bind setsockopt ioctlsocket connect WSAGetLastError closesocket WSAIoctl WSASocketW freeaddrinfo WSACleanup WSAStartup getaddrinfo shutdown getsockopt

secur32

InitializeSecurityContextW ApplyControlToken DecryptMessage EncryptMessage AcceptSecurityContext AcquireCredentialsHandleA FreeContextBuffer DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle

crypt32

CertDuplicateCertificateChain CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CertDuplicateStore

ntdll

NtWriteFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile NtOpenFile NtReadFile

shell32

ShellExecuteW

user32

ReleaseDC MessageBoxW GetDC GetSystemMetrics SystemParametersInfoW

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetDIBits DeleteObject

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

vcruntime140

__current_exception_context __CxxFrameHandler3 memcpy memmove __current_exception __C_specific_handler _CxxThrowException memcmp memset

api-ms-win-crt-math-l1-1-0

fmaf ceilf pow fma expf floorf roundf sinf __setusermatherr exp ceil log2 powf truncf log2f round

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _wassert _seh_filter_exe _set_app_type terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initialize_onexit_table _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit

api-ms-win-crt-heap-l1-1-0

calloc free malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

ws2_32

secur32

crypt32

ntdll

shell32

user32

gdi32

ole32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic