2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer
Size 6.3MB
Sample260804-nnvp2ayfmb
SHA256 3e3b19a34ed77452d1d75634dfb1b237e6c894957cd8387c675e7503ba68de11
MD5 696f9043bd1fe24bc884ca4ccd987a33
SHA1 164b556d5facda9660057dc6180ecbbd5b1d6288
SHA512 80693f7c54050e37aae5b6828cca75c64157fdf41ec4cd667bf719cd4ce7b4f7e163905dea248a162cfa910d17fd279e27b40a6596cf36c46bd31fd4b42a236d
SSDEEP 98304:TXROZU7NWW+8VtGwKlircVu/ntyG48Cs1jHqrOhFF44HosfQE:SsMVhsfQ
TLSH
T172662915BA5BA8EDC55AC870834A4A736E2170CB0B36B9FB41C486393F69AF05F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer

.exe 6.3MB

2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer

IMPHASH fc96ef2fd7e4534028df0fb277d9cc37
SHA256 3e3b19a34ed77452d1d75634dfb1b237e6c894957cd8387c675e7503ba68de11
MD5 696f9043bd1fe24bc884ca4ccd987a33
SHA1 164b556d5facda9660057dc6180ecbbd5b1d6288
SHA512 80693f7c54050e37aae5b6828cca75c64157fdf41ec4cd667bf719cd4ce7b4f7e163905dea248a162cfa910d17fd279e27b40a6596cf36c46bd31fd4b42a236d
SSDEEP 98304:TXROZU7NWW+8VtGwKlircVu/ntyG48Cs1jHqrOhFF44HosfQE:SsMVhsfQ
TLSH
T172662915BA5BA8EDC55AC870834A4A736E2170CB0B36B9FB41C486393F69AF05F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4741116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

blue_onyx_benchmark.pdb

kernel32

CreateSymbolicLinkW GetLastError lstrlenW GetFinalPathNameByHandleW SetFileCompletionNotificationModes GetLogicalProcessorInformation SetLastError GetFileInformationByHandleEx CreateFileW FreeLibrary SetHandleInformation GetProcAddress LoadLibraryExA DeleteFileW FindClose FindFirstFileExW GetSystemTimePreciseAsFileTime SetConsoleCursorPosition SetFilePointerEx GetConsoleScreenBufferInfo SetThreadStackGuarantee GetCurrentThread SwitchToThread SetConsoleTextAttribute FillConsoleOutputAttribute GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte GetFileInformationByHandle GetFullPathNameW CreateDirectoryW MoveFileExW CopyFileExW GetFileType FindNextFileW SetFileInformationByHandle SetConsoleMode Sleep SetWaitableTimer HeapReAlloc FormatMessageW GetConsoleMode HeapAlloc HeapFree GetProcessHeap FillConsoleOutputCharacterA GetStdHandle ExitProcess GetModuleFileNameW GetModuleHandleA GetSystemInfo ReleaseMutex GetCurrentProcess LoadLibraryA WaitForSingleObjectEx GetCurrentProcessId GetModuleHandleW LoadLibraryExW UnlockFile WaitForSingleObject CloseHandle FlushFileBuffers HeapSize LCMapStringW CompareStringW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetSystemTimeAsFileTime FlsFree FlsSetValue EncodePointer GetCurrentThreadId GetStartupInfoW IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess GetModuleHandleExW FlsAlloc FlsGetValue InitializeCriticalSectionEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA WriteFile InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead LockFileEx CreateThread QueryPerformanceFrequency GetEnvironmentVariableW RtlVirtualUnwind CreateMutexA RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW PostQueuedCompletionStatus SetThreadErrorMode CreateIoCompletionPort GetQueuedCompletionStatusEx CreateWaitableTimerExW QueryPerformanceCounter AddVectoredExceptionHandler GetCommandLineW

ntdll

NtDeviceIoControlFile NtCreateFile NtReadFile NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError

oleaut32

SysFreeString SysStringLen GetErrorInfo

ole32

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

dxgi

CreateDXGIFactory1

crypt32

CertFreeCertificateContext CertOpenStore CertCloseStore CertGetCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertEnumCertificatesInStore CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

shell32

SHGetKnownFolderPath

secur32

EncryptMessage AcceptSecurityContext QueryContextAttributesW ApplyControlToken DecryptMessage DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW AcquireCredentialsHandleA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

ws2_32

getpeername setsockopt closesocket WSASocketW ioctlsocket WSAIoctl bind connect getsockopt getaddrinfo freeaddrinfo WSAStartup WSACleanup recv send WSASend shutdown getsockname WSAGetLastError

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_696f9043bd1fe24bc884ca4ccd987a33_akira_glassworm_icedid_rusty-stealer

kernel32

ntdll

oleaut32

ole32

api-ms-win-core-synch-l1-2-0

dxgi

crypt32

bcryptprimitives

shell32

secur32

advapi32

ws2_32

generic