69614665baefda034c5f5da3502edf9a6ab23c8442592e968b9fe09e42487ac8

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6092	powershell.exe
2680	powershell.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6092	powershell.exe
6092	powershell.exe
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe
6092	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeIncreaseQuotaPrivilege	6092	powershell.exe
Token: SeSecurityPrivilege	6092	powershell.exe
Token: SeTakeOwnershipPrivilege	6092	powershell.exe
Token: SeLoadDriverPrivilege	6092	powershell.exe
Token: SeSystemProfilePrivilege	6092	powershell.exe
Token: SeSystemtimePrivilege	6092	powershell.exe
Token: SeProfSingleProcessPrivilege	6092	powershell.exe
Token: SeIncBasePriorityPrivilege	6092	powershell.exe
Token: SeCreatePagefilePrivilege	6092	powershell.exe
Token: SeBackupPrivilege	6092	powershell.exe
Token: SeRestorePrivilege	6092	powershell.exe
Token: SeShutdownPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeSystemEnvironmentPrivilege	6092	powershell.exe
Token: SeRemoteShutdownPrivilege	6092	powershell.exe
Token: SeUndockPrivilege	6092	powershell.exe
Token: SeManageVolumePrivilege	6092	powershell.exe
Token: 33	6092	powershell.exe
Token: 34	6092	powershell.exe
Token: 35	6092	powershell.exe
Token: 36	6092	powershell.exe
Token: SeIncreaseQuotaPrivilege	6092	powershell.exe
Token: SeSecurityPrivilege	6092	powershell.exe
Token: SeTakeOwnershipPrivilege	6092	powershell.exe
Token: SeLoadDriverPrivilege	6092	powershell.exe
Token: SeSystemProfilePrivilege	6092	powershell.exe
Token: SeSystemtimePrivilege	6092	powershell.exe
Token: SeProfSingleProcessPrivilege	6092	powershell.exe
Token: SeIncBasePriorityPrivilege	6092	powershell.exe
Token: SeCreatePagefilePrivilege	6092	powershell.exe
Token: SeBackupPrivilege	6092	powershell.exe
Token: SeRestorePrivilege	6092	powershell.exe
Token: SeShutdownPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeSystemEnvironmentPrivilege	6092	powershell.exe
Token: SeRemoteShutdownPrivilege	6092	powershell.exe
Token: SeUndockPrivilege	6092	powershell.exe
Token: SeManageVolumePrivilege	6092	powershell.exe
Token: 33	6092	powershell.exe
Token: 34	6092	powershell.exe
Token: 35	6092	powershell.exe
Token: 36	6092	powershell.exe
Token: SeIncreaseQuotaPrivilege	6092	powershell.exe
Token: SeSecurityPrivilege	6092	powershell.exe
Token: SeTakeOwnershipPrivilege	6092	powershell.exe
Token: SeLoadDriverPrivilege	6092	powershell.exe
Token: SeSystemProfilePrivilege	6092	powershell.exe
Token: SeSystemtimePrivilege	6092	powershell.exe
Token: SeProfSingleProcessPrivilege	6092	powershell.exe
Token: SeIncBasePriorityPrivilege	6092	powershell.exe
Token: SeCreatePagefilePrivilege	6092	powershell.exe
Token: SeBackupPrivilege	6092	powershell.exe
Token: SeRestorePrivilege	6092	powershell.exe
Token: SeShutdownPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeSystemEnvironmentPrivilege	6092	powershell.exe
Token: SeRemoteShutdownPrivilege	6092	powershell.exe
Token: SeUndockPrivilege	6092	powershell.exe
Token: SeManageVolumePrivilege	6092	powershell.exe
Token: 33	6092	powershell.exe
Token: 34	6092	powershell.exe
Token: 35	6092	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 6092	5868	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe	88
PID 5868 wrote to memory of 2680	5868	2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_98ced95f4556ddc726877656a2a14462_akira_glassworm_rusty-stealer.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Identifies Wine through registry keys
- Windows security modification
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAFMAYwByAGkAcAB0AFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBNAEEAUABTAFIAZQBwAG8AcgB0AGkAbgBnACAAMAAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion