2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer
Size 4.2MB
Sample260803-hdlrgsdk21
SHA256 62e7076177af1e94b3a1ed85eb7d9f1cc3b6533a22b38e7bef85f31b5310f644
MD5 c445d0c4862aa255f947e9f9f33bf145
SHA1 48c4e65eabb7fb3785a6d8675c60031012e8b84b
SHA512 69aec58cf4818780b02fbf841b76e1b89b13d2ec6d28257e5e2992bb526afc2e85e8c0f0921766211a86518d4216aa989d55b92b4f15215974c3aed1d6a22910
SSDEEP 98304:Mx2X4m/so7l++++++vC++++++++++++++++++Q++0iR:P4jox++++++vC++++++++++++++++++U
TLSH
T16E166C12B6A540ADD06BC074C7574623EB3170CA1735AAFB65D882B93F66EF11B3E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer

File Explorer

2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer

.exe 4.2MB

2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer

IMPHASH fea220a14f4423c33208f64144a93449
SHA256 62e7076177af1e94b3a1ed85eb7d9f1cc3b6533a22b38e7bef85f31b5310f644
MD5 c445d0c4862aa255f947e9f9f33bf145
SHA1 48c4e65eabb7fb3785a6d8675c60031012e8b84b
SHA512 69aec58cf4818780b02fbf841b76e1b89b13d2ec6d28257e5e2992bb526afc2e85e8c0f0921766211a86518d4216aa989d55b92b4f15215974c3aed1d6a22910
SSDEEP 98304:Mx2X4m/so7l++++++vC++++++++++++++++++Q++0iR:P4jox++++++vC++++++++++++++++++U
TLSH
T16E166C12B6A540ADD06BC074C7574623EB3170CA1735AAFB65D882B93F66EF11B3E318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3229680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

restore_contract-d5f60e7390f29294.pdb

kernel32

GetCurrentProcessId GetModuleHandleW FreeLibrary WideCharToMultiByte FlushFileBuffers GetConsoleMode GetFileInformationByHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetFileSize DeleteFileW GetProcAddress DeleteFileA WaitForSingleObjectEx LoadLibraryW CreateFileA GetFileAttributesExW GetFileAttributesA GetTempPathA CloseHandle MultiByteToWideChar GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW AreFileApisANSI GetCurrentThreadId LoadLibraryA GetFileInformationByHandleEx SetFileInformationByHandle GetDriveTypeW CreateEventW GetProcessHeap HeapAlloc HeapFree IsProcessorFeaturePresent GetDiskFreeSpaceExW GetModuleHandleA FormatMessageW MoveFileExW GetLastError Sleep ReplaceFileW UnlockFile LocalFree GetDiskFreeSpaceA GetExitCodeProcess InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW WaitForMultipleObjects GetFileType SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetEnvironmentStringsW TerminateProcess IsDebuggerPresent CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetOverlappedResult ReadFileEx CreateThread QueryPerformanceFrequency SetFileTime SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException ReadFile HeapCreate WriteFile OutputDebugStringA UnlockFileEx UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile HeapReAlloc GetNativeSystemInfo GetSystemInfo HeapCompact HeapDestroy LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context memcmp __CxxFrameHandler3 memcpy memmove strchr strrchr __C_specific_handler memset memchr _CxxThrowException __current_exception

api-ms-win-crt-math-l1-1-0

log floor fmod __setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp strspn strcspn strncmp strlen

api-ms-win-crt-heap-l1-1-0

malloc _msize free _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _cexit __p___argv __p___argc _seh_filter_exe _initialize_onexit_table _endthreadex _crt_atexit _get_initial_narrow_environment _exit _initterm exit _set_app_type _register_onexit_function _configure_narrow_argv _beginthreadex _initterm_e

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_c445d0c4862aa255f947e9f9f33bf145_akira_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic