2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer
Size 15.4MB
Sample260804-y63hpsyhld
SHA256 ad52bb9ea8ecbff4bf043d671b10911fee79456d8a639793b51ad3414a26e0e2
MD5 496389310208a481faf62930407e1ab7
SHA1 7e6adc00d457728236c5e0694af9366fb0a5185e
SHA512 30fc66fe2a88584a9f20d3a41af3084f3a4a45484dd2340a9c76db3e9231e0a560608bef039db33b5a00f373e0efade35999ae8f48cae38c917663f175b9dec8
SSDEEP 196608:GWL4VoGQwbrMy+dANPON7PhME5meHR8dTPRf1qu2GAW7D:d4CLGrMy+daPM7PaleHWdldzXv7D
TLSH
T1EDF69D03F75181ECC16AC074825A6272E631BC4A07347AEB7BEC5B212F65BA06F7D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer

File Explorer

2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer

.exe 15.4MB

2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer

SHA256 ad52bb9ea8ecbff4bf043d671b10911fee79456d8a639793b51ad3414a26e0e2
MD5 496389310208a481faf62930407e1ab7
SHA1 7e6adc00d457728236c5e0694af9366fb0a5185e
SHA512 30fc66fe2a88584a9f20d3a41af3084f3a4a45484dd2340a9c76db3e9231e0a560608bef039db33b5a00f373e0efade35999ae8f48cae38c917663f175b9dec8
SSDEEP 196608:GWL4VoGQwbrMy+dANPON7PhME5meHR8dTPRf1qu2GAW7D:d4CLGrMy+daPM7PaleHWdldzXv7D
TLSH
T1EDF69D03F75181ECC16AC074825A6272E631BC4A07347AEB7BEC5B212F65BA06F7D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17616984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

145KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.exports

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_496389310208a481faf62930407e1ab7_akira_glassworm_rusty-stealer

generic