2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer
Size 3.1MB
Sample260805-eppezaxgre
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer

.exe 3.1MB

2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer

IMPHASH 1943f768e29df3759bf4b7621cec8db2
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2251036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

TelePack.pdb

kernel32

GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetProcAddress GetModuleHandleW GetSystemTimePreciseAsFileTime GetLastError HeapReAlloc CloseHandle HeapFree SetLastError LoadLibraryA HeapAlloc SetHandleInformation GetModuleHandleA GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle LoadLibraryExW FreeLibrary HeapSize VirtualProtect GetModuleHandleExW GetSystemTimeAsFileTime GetComputerNameExW GetProcessHeap InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA WriteFile TlsFree TlsSetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW MoveFileExW CopyFileExW SwitchToThread DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetFileAttributesW CompareStringW LCMapStringW FlushFileBuffers SetFilePointerEx TlsGetValue GetOverlappedResult FindClose Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter SetThreadExecutionState CreateThread CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess QueryFullProcessImageNameW IsDebuggerPresent CreateMutexW FreeEnvironmentStringsW GetCurrentProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx FormatMessageW GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile GetEnvironmentStringsW CompareStringOrdinal CreateProcessW

secur32

QueryContextAttributesW InitializeSecurityContextW ApplyControlToken FreeContextBuffer EncryptMessage DeleteSecurityContext FreeCredentialsHandle DecryptMessage AcquireCredentialsHandleA AcceptSecurityContext

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertCloseStore CertFreeCertificateContext CertDuplicateCertificateChain CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore

ntdll

NtSuspendProcess NtCreateNamedPipeFile NtOpenFile NtResumeProcess RtlNtStatusToDosError NtWriteFile NtReadFile

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegDeleteValueW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegCreateKeyExW RegSetValueExW

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSAStartup select connect ioctlsocket getsockname WSACleanup WSASocketW WSADuplicateSocketW getsockopt setsockopt WSASend closesocket freeaddrinfo getaddrinfo WSAGetLastError getpeername send WSARecv recv

shell32

ShellExecuteW

user32

GetSystemMetrics SetProcessDPIAware ShowWindow SendMessageW keybd_event GetForegroundWindow EnumWindows IsWindowVisible GetWindowTextW GetDC GetLastInputInfo mouse_event BlockInput GetAsyncKeyState GetWindowThreadProcessId SetCursorPos

gdi32

GetDIBits DeleteObject DeleteDC GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer

kernel32

secur32

crypt32

ntdll

bcryptprimitives

advapi32

bcrypt

api-ms-win-core-synch-l1-2-0

ws2_32

shell32

user32

gdi32

generic