2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer
Size 3.4MB
Sample260804-lb7sqagg55
SHA256 cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5
MD5 dbc9c8acae88b0ef00fef47ab8e166a0
SHA1 fa3551bdc52d030a0908ff0c714a13d440a77ce4
SHA512 5d2d500be7a727cee6cc30eca0ebb7590b63d98bbb264004693a9f19d970acf60211ced1bd7a7cfdfe86fdcff5dd2af0f75a4c22a9c2cc9899c7dedb68deb910
SSDEEP 49152:H1gxn3ar2vWv7S/w2cFUFFgOxUjwrifdysdnpJfjZuFN:W3a8WvOF/KfdyO/fjZu
TLSH
T19EF52943E79600E5D5BBC175CE169227BB71385807F1A7A772805AD22FB2FB07A2D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer

File Explorer

2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer

.exe 3.4MB

2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer

IMPHASH cd0363179b86115109a40cc23582bb1f
SHA256 cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5
MD5 dbc9c8acae88b0ef00fef47ab8e166a0
SHA1 fa3551bdc52d030a0908ff0c714a13d440a77ce4
SHA512 5d2d500be7a727cee6cc30eca0ebb7590b63d98bbb264004693a9f19d970acf60211ced1bd7a7cfdfe86fdcff5dd2af0f75a4c22a9c2cc9899c7dedb68deb910
SSDEEP 49152:H1gxn3ar2vWv7S/w2cFUFFgOxUjwrifdysdnpJfjZuFN:W3a8WvOF/KfdyO/fjZu
TLSH
T19EF52943E79600E5D5BBC175CE169227BB71385807F1A7A772805AD22FB2FB07A2D384
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of MFA browser extension IDs.
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2763172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

krysa_mini.pdb

user32

IsClipboardFormatAvailable OpenClipboard EnumDisplayDevicesA CloseDesktop SetThreadDesktop CreateDesktopW GetSystemMetrics GetClipboardData CloseClipboard OpenDesktopW

kernel32

OpenProcess GetProcessTimes ReadProcessMemory VirtualQueryEx GetWindowsDirectoryW GetSystemDirectoryW GetDiskFreeSpaceExW GlobalMemoryStatusEx GetSystemTimePreciseAsFileTime GetComputerNameExW PostQueuedCompletionStatus CreateIoCompletionPort FindFirstFileExW LoadLibraryExA CreateDirectoryW FindNextFileW SetFilePointerEx GetFullPathNameW GetModuleFileNameW GetTempPathW GetSystemInfo FormatMessageW GetModuleHandleW Sleep SetHandleInformation CopyFileExW SetWaitableTimer CreateWaitableTimerExW GetModuleHandleA WaitForSingleObject ReleaseMutex CreateMutexA GetCurrentProcessId GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetFileInformationByHandle GetQueuedCompletionStatusEx GetFinalPathNameByHandleW CreateToolhelp32Snapshot Process32First Process32Next RemoveDirectoryW HeapFree GetProcessHeap GetCurrentThread DeleteFileW SetLastError GetProcessIoCounters SetThreadStackGuarantee UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSizeEx DuplicateHandle HeapAlloc GetExitCodeProcess AddVectoredExceptionHandler WaitForMultipleObjects InitializeSListHead GetCurrentDirectoryW ReadFile WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency WriteFile GlobalUnlock GlobalLock GetSystemTime CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW CreateNamedPipeW QueryPerformanceCounter GetOverlappedResult CancelIo CreateEventW SleepEx WriteFileEx ReadFileEx DeviceIoControl LocalFree CreateFileW HeapReAlloc K32GetPerformanceInfo LocalAlloc GetFileInformationByHandleEx SetFileInformationByHandle GetCurrentProcess GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW FindVolumeClose FlushFileBuffers GetTickCount CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId FindNextVolumeW CreateThread GetSystemTimes FindFirstVolumeW lstrlenW TerminateProcess CreateRemoteThread IsProcessorFeaturePresent IsDebuggerPresent FindClose WriteProcessMemory GetLastError VirtualAllocEx SwitchToThread CloseHandle CreateProcessW UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileAttributesW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

wininet

InternetReadFile HttpOpenRequestA InternetConnectA InternetOpenA InternetWriteFile HttpSendRequestExA InternetCloseHandle HttpAddRequestHeadersA HttpEndRequestA

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError RtlVirtualUnwind RtlCaptureContext NtDeviceIoControlFile NtCancelIoFileEx NtQueryObject NtQuerySystemInformation NtOpenFile RtlGetVersion NtQueryInformationProcess

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036 CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken

gdi32

CreateDCW CreateCompatibleBitmap CreateCompatibleDC DeleteObject DeleteDC BitBlt SelectObject GetDIBits

rstrtmgr

RmStartSession RmEndSession RmGetList RmRegisterResources

oleaut32

SysFreeString SysAllocString VariantClear SysStringLen GetErrorInfo

bcryptprimitives

ProcessPrng

ws2_32

WSAGetLastError WSACleanup freeaddrinfo WSASocketW connect recv getaddrinfo WSAStartup send closesocket

crypt32

CryptUnprotectData

iphlpapi

FreeMibTable GetIfTable2 GetAdaptersAddresses

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance

pdh

PdhRemoveCounter PdhCloseQuery PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA PdhEnumObjectsA PdhCollectQueryData

powrprof

CallNtPowerInformation

vcruntime140

__intrinsic_setjmp __C_specific_handler longjmp strrchr memcmp memset memmove __CxxFrameHandler3 memcpy __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strcmp wcslen _stricmp isdigit strncmp strlen strcspn

api-ms-win-crt-heap-l1-1-0

_set_new_mode _msize malloc free realloc

api-ms-win-crt-math-l1-1-0

log __setusermatherr pow _dclass

api-ms-win-crt-runtime-l1-1-0

exit strerror_s __p___argc _exit _c_exit _initterm_e _initterm _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _errno _cexit _set_app_type _seh_filter_exe terminate _endthreadex _register_onexit_function _beginthreadex _initialize_onexit_table _crt_atexit __p___argv _get_initial_narrow_environment

api-ms-win-crt-utility-l1-1-0

qsort abs

api-ms-win-crt-environment-l1-1-0

getenv_s _putenv_s

api-ms-win-crt-stdio-l1-1-0

feof fopen_s fclose getc __stdio_common_vsscanf ungetc __stdio_common_vsnprintf_s putc fwrite fflush __acrt_iob_func ferror fread __p__commode __stdio_common_vfprintf _set_fmode

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer

user32

kernel32

api-ms-win-core-synch-l1-2-0

wininet

ntdll

advapi32

gdi32

rstrtmgr

oleaut32

bcryptprimitives

ws2_32

crypt32

iphlpapi

setupapi

bcrypt

psapi

shell32

ole32

pdh

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic