2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer
Size 3.2MB
Sample260804-nfph2sab96
SHA256 12eb46f9e3957ac46c2b49e708d720fbac65c55fd981a0d92c8a168b809f75fb
MD5 74d0287ee6cc71e3c05a4f66939fbe8f
SHA1 e1ecfc611a6e660cf5dd2194e3db68ed2d2e5890
SHA512 f1575bbda754e977a364683fdb26f342ff960a7e549e8bfd2d3b99142b9e324987df9af3c9b811d10e75da8b29fa1e1c3e717b0bcd767d9db42a6dc4b47cc0d0
SSDEEP 49152:7Gez4Ey67CDDiFor0m49rkuIlXq0x3gy/c4oewt54q:RcQ
TLSH
T156F539117A5B98ADD59AC474C3468A631E2130DB0B36B9FF41C856393F6ABF01F2C768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer

.exe 3.2MB

2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer

IMPHASH 7155f414a78840bf22ec11dd93a61850
SHA256 12eb46f9e3957ac46c2b49e708d720fbac65c55fd981a0d92c8a168b809f75fb
MD5 74d0287ee6cc71e3c05a4f66939fbe8f
SHA1 e1ecfc611a6e660cf5dd2194e3db68ed2d2e5890
SHA512 f1575bbda754e977a364683fdb26f342ff960a7e549e8bfd2d3b99142b9e324987df9af3c9b811d10e75da8b29fa1e1c3e717b0bcd767d9db42a6dc4b47cc0d0
SSDEEP 49152:7Gez4Ey67CDDiFor0m49rkuIlXq0x3gy/c4oewt54q:RcQ
TLSH
T156F539117A5B98ADD59AC474C3468A631E2130DB0B36B9FF41C856393F6ABF01F2C768
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2095260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

test_blue_onyx.pdb

kernel32

GetModuleFileNameW SetThreadStackGuarantee GetCurrentThread SwitchToThread GetProcAddress SetHandleInformation GetConsoleOutputCP GetFinalPathNameByHandleW WriteConsoleW lstrlenW WideCharToMultiByte GetFileType FillConsoleOutputAttribute GetLastError GetModuleHandleW GetFileInformationByHandleEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetStdHandle HeapReAlloc SetLastError CreateFileW GetFullPathNameW FillConsoleOutputCharacterA SetFileCompletionNotificationModes FormatMessageW HeapAlloc HeapFree GetProcessHeap MultiByteToWideChar ExitProcess GetModuleHandleA SetConsoleCursorPosition WaitForSingleObject GetCurrentProcessId WaitForSingleObjectEx LoadLibraryA GetCurrentProcess ReleaseMutex GetConsoleMode SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW CloseHandle VirtualProtect GetStringTypeW FreeLibrary EncodePointer GetCurrentThreadId GetStartupInfoW IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW TerminateProcess GetModuleHandleExW FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle CreateThread InitializeCriticalSectionEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA WriteFile InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead QueryPerformanceFrequency GetEnvironmentVariableW RtlVirtualUnwind CreateMutexA RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx AddVectoredExceptionHandler GetCommandLineW QueryPerformanceCounter

ntdll

RtlNtStatusToDosError NtWriteFile NtCancelIoFileEx NtDeviceIoControlFile NtReadFile NtCreateFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

crypt32

CertDuplicateStore CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertGetCertificateChain CertDuplicateCertificateChain

bcryptprimitives

ProcessPrng

secur32

EncryptMessage DeleteSecurityContext AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW DecryptMessage AcquireCredentialsHandleA FreeContextBuffer FreeCredentialsHandle ApplyControlToken

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

ws2_32

WSASocketW getsockname WSAGetLastError getpeername closesocket setsockopt ioctlsocket WSAIoctl bind connect getsockopt getaddrinfo WSAStartup WSACleanup recv send WSASend shutdown freeaddrinfo

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_74d0287ee6cc71e3c05a4f66939fbe8f_akira_glassworm_icedid_rusty-stealer

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

crypt32

bcryptprimitives

secur32

advapi32

ws2_32

generic