28e89fc56598978799b87b3d177464a112da174fceb61512919c514a7e90ea20

General

Target
2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe
Size 11.4MB
Sample260803-k64twafl71
SHA256 28e89fc56598978799b87b3d177464a112da174fceb61512919c514a7e90ea20
MD5 5fc00a8f461f8a975d4566013f2c4448
SHA1 eb8c7f40883ddd5228863d53971d17dfb42a5f49
SHA512 9e07b9fef143846a05d889fe6f84071170f22f9ce5abbb8a3646ceab520431ad939a93961453b6835557266a3711bad2fb3872180c39bcc23a70087fac03209b
SSDEEP 196608:kKZLZTIfLDwFDHmCT4cYNQJQKw7xE844naSVi3tCAatKjLSNPEblk21H1:tZRIfLsFzmCT4zKw7xvaSEdM+ishku1
TLSH
T179C63353F091637BC90B0135285EE779BA368D64472699E3F1A83CA144F3BE10D7AE6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6004	rustdesk.exe
1392	rustdesk.exe
6108	rustdesk.exe
5652	rustdesk.exe

Loads dropped DLL 2 IoCs

pid	Process
6004	rustdesk.exe
6004	rustdesk.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\rustdesk_rCURRENT.log	rustdesk.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_F78252DAEF049863	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4040	taskkill.exe
4388	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6004	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	rustdesk.exe
1392	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	1392	rustdesk.exe
Token: SeDebugPrivilege	4040	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6004	rustdesk.exe
6004	rustdesk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 4388	6064	2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe	91
PID 6064 wrote to memory of 6004	6064	2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe	94
PID 6004 wrote to memory of 1392	6004	rustdesk.exe	95
PID 6004 wrote to memory of 4672	6004	rustdesk.exe	96
PID 6004 wrote to memory of 6108	6004	rustdesk.exe	98
PID 4672 wrote to memory of 4040	4672	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5fc00a8f461f8a975d4566013f2c4448_akira_amadey_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_6004_56d5a1e5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_6004_56d5a1e5
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4040
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service_6004_56d5a1e5

Path C:\ProgramData\RustDesk\portable_service_shmem\shared_memory_portable_service_6004_56d5a1e5
Size 23B
SHA256 6a6b40738387a690c40ee4cf51bcbe73a53afd905fad4588223304f9ef92a659
MD5 8747d36e6ec77bb90aca6a23d3f46c7d
SHA1 cbecb28e23b5aab1006c14d099b1580f691565ba
SHA512 f00933892b42de18e5fc74d7d94a49a527123ef52ecc5bcb8a97ad752544573aa8fc351bf55790ebd11ec82b616ff405e287bfeeaa89e1662142e49c08665351
MD5 SHA1 SHA512

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 30.1MB
SHA256 66ca84cf45e8e9d66478a0e3d3f0cf857fc90783f70a0615ec71a4cbd0a6afdd
MD5 c9a36390d375d79b94fa1cc957e88527
SHA1 6e0ed39e8b958e4f977c749d609ce19a6a9eec55
SHA512 51d508551555860764778279b1c1a2605c1719ab38202616e6f3f6b59e94a3fb0696c8577ca49a363a5ed31fa4c1a40388bd2439569beeb13b3967570418f416
SSDEEP 786432:hGdZRN6JfYZVnK1mrrZBiT/BCmrJwWEIM9Cjj:hG9Pu
TLSH
T13E679D41E787A6B0D8861430206FB73BAB391D18431ACBF3E7D46E71A9737D1593AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\sciter.dll
Size 5.8MB
SHA256 3fc688ff6cd79588153216628d81eaf7eea4467949550f069fc2c38f5a8855b2
MD5 93c10606845c6c83ebc35dbd78e1490e
SHA1 05b0ef0e47965ec63f33160b5c7781551d125a62
SHA512 faeeb129fb4fa742d8309e383c563b363a73d9e35e67e48dd53f49d8f2c8795929fe1cddb91b8a53b8d72402594095c173729bc801047d48aef412e8140ce320
SSDEEP 98304:wKwCpE+mBoEBDeasdzH/cs8cfQW6OUiCpIWLQCIFBRQlt3RHffOYVvsIrqNkJW6T:wKL/ERqH/TQW6OKuWL6FERAIrqNp/8V
TLSH
T1E756AF23BB95803DC42F02B06E6EF37D81FABE7005B0412B2BB87E5D6EB09E15655563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads