2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer
Size 3.1MB
Sample260806-qa5deswtfs
SHA256 42972842d81158163f68ba9e7a8e21212c4a6bea893ba1654d74cf161d4d7cff
MD5 aa29448ce24b15ded5d4559a5d4f9911
SHA1 a19e3bc9c12503c927ff82514f9b9766f13d8543
SHA512 06a2c06d135b9647bee3e4c375a3e9bd3db56d35477c8d6d12181ee9fc78b776b788d19c7c66804dc60c2baf58583947243a2be99b25c0ad9ac337396fb51e29
SSDEEP 49152:YTTLftu4NIMOP5P1Ml2p2PVWN14zHXMuVrUO6ChFM2b8/0q4IU6i1O/P:Y04zs1hCG3C0CGH+
TLSH
T108E54B42BA9B94ECC15AC474C34A4A736E2174CB1726B9FF46D496383F6ABE05B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer

.exe 3.1MB

2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer

IMPHASH 9ffcf6543744996a6f401e714fe15714
SHA256 42972842d81158163f68ba9e7a8e21212c4a6bea893ba1654d74cf161d4d7cff
MD5 aa29448ce24b15ded5d4559a5d4f9911
SHA1 a19e3bc9c12503c927ff82514f9b9766f13d8543
SHA512 06a2c06d135b9647bee3e4c375a3e9bd3db56d35477c8d6d12181ee9fc78b776b788d19c7c66804dc60c2baf58583947243a2be99b25c0ad9ac337396fb51e29
SSDEEP 49152:YTTLftu4NIMOP5P1Ml2p2PVWN14zHXMuVrUO6ChFM2b8/0q4IU6i1O/P:Y04zs1hCG3C0CGH+
TLSH
T108E54B42BA9B94ECC15AC474C34A4A736E2174CB1726B9FF46D496383F6ABE05B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2252444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MessagingSvc.pdb

kernel32

GetComputerNameExW GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetProcAddress GetModuleHandleW GetSystemTimePreciseAsFileTime GetLastError CloseHandle HeapFree SetLastError LoadLibraryA HeapAlloc SetHandleInformation GetModuleHandleA GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle LoadLibraryExW FreeLibrary HeapSize VirtualProtect GetModuleHandleExW GetSystemTimeAsFileTime HeapReAlloc GetProcessHeap InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA WriteFile TlsFree TlsSetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW MoveFileExW CopyFileExW SwitchToThread DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetFileAttributesW CompareStringW LCMapStringW FlushFileBuffers SetFilePointerEx TlsGetValue GetOverlappedResult FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess CreateThread QueryFullProcessImageNameW IsDebuggerPresent CreateMutexW FreeEnvironmentStringsW GetCurrentProcess Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter SetThreadExecutionState AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx FormatMessageW GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile GetEnvironmentStringsW CompareStringOrdinal CreateProcessW

secur32

AcceptSecurityContext DeleteSecurityContext ApplyControlToken FreeCredentialsHandle DecryptMessage QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcquireCredentialsHandleA EncryptMessage

crypt32

CertFreeCertificateChain CertGetCertificateChain CertDuplicateCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 GetTokenInformation GetUserNameW RegSetValueExW OpenProcessToken RegCloseKey RegDeleteValueW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegCreateKeyExW

ntdll

NtSuspendProcess NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtResumeProcess NtWriteFile NtReadFile

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

shell32

ShellExecuteW

user32

GetAsyncKeyState IsWindowVisible SetProcessDPIAware ShowWindow GetWindowTextW keybd_event EnumWindows BlockInput GetForegroundWindow GetWindowThreadProcessId SendMessageW SetCursorPos GetDC GetSystemMetrics GetLastInputInfo mouse_event

ws2_32

closesocket getsockopt setsockopt recv getsockname ioctlsocket connect select WSAStartup WSAGetLastError send WSACleanup WSASocketW WSADuplicateSocketW WSASend freeaddrinfo getaddrinfo getpeername WSARecv

gdi32

DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_aa29448ce24b15ded5d4559a5d4f9911_akira_glassworm_icedid_rusty-stealer

kernel32

secur32

crypt32

bcryptprimitives

advapi32

ntdll

bcrypt

api-ms-win-core-synch-l1-2-0

shell32

user32

ws2_32

gdi32

generic