2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer
Size 5.1MB
Sample260807-gj2t8aec22
SHA256 fcb0e786d7b9bc4555ef2be5a04ed5e7af458609170f7665918233dbb46171e1
MD5 ad405503cf210a082e0368b57764a160
SHA1 d8cdb09e6066583f5daa1e6298a32433d0c1d2b7
SHA512 96299a1b7b2864f1b6060a6d91cc3778988ce8f24c4ad23bedc43e4b896058a774a2bf8e225f84716e215e4baf457f44ebdd66521493b2a4ade8ba80c5bf819e
SSDEEP 98304:ghzQvIqdWTUkqYM3qTLi/wujznoZijxrn+fU:WNRqYMGi4uj7jxLOU
TLSH
T1A8369D03F6A541E9D0AEC17AC71B9623EB72B88E1620B7DB17D44A613F23B601F9D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer

File Explorer

2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer

.exe 5.1MB

2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer

IMPHASH 4c480e7cb6236733ed22c88d9fc225f2
SHA256 fcb0e786d7b9bc4555ef2be5a04ed5e7af458609170f7665918233dbb46171e1
MD5 ad405503cf210a082e0368b57764a160
SHA1 d8cdb09e6066583f5daa1e6298a32433d0c1d2b7
SHA512 96299a1b7b2864f1b6060a6d91cc3778988ce8f24c4ad23bedc43e4b896058a774a2bf8e225f84716e215e4baf457f44ebdd66521493b2a4ade8ba80c5bf819e
SSDEEP 98304:ghzQvIqdWTUkqYM3qTLi/wujznoZijxrn+fU:WNRqYMGi4uj7jxLOU
TLSH
T1A8369D03F6A541E9D0AEC17AC71B9623EB72B88E1620B7DB17D44A613F23B601F9D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing common artifacts observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2619888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Vodolazik.pdb

kernel32

Process32Next OpenProcess GetModuleHandleA GetProcAddress VirtualAllocEx WriteProcessMemory CreateRemoteThread SetHandleInformation AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc SwitchToThread GetTickCount GetTempPathW GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW GetFileInformationByHandleEx ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleFileNameW QueryPerformanceFrequency CreateThread SleepEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer Sleep CreateEventW CompareStringOrdinal GetSystemDirectoryW Process32First CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW DeleteFileW GetExitCodeProcess GetFileInformationByHandle FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW GetSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetFileInformationByHandle GetCurrentProcess GetCommandLineW CreateFileW CreateMutexA FindFirstFileExW GetFullPathNameW CreateDirectoryW GetOverlappedResult WriteFileEx ReadFileEx ReadFile GetFileAttributesW SetFileCompletionNotificationModes CreateIoCompletionPort UnhandledExceptionFilter GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError CreateToolhelp32Snapshot SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead WaitForMultipleObjects DuplicateHandle CancelIo PostQueuedCompletionStatus GetWindowsDirectoryW GetTimeZoneInformationForYear IsDebuggerPresent LocalFree CloseHandle CopyFileExW GetLastError FindClose GetCurrentProcessId FindNextFileW

advapi32

RegCloseKey SystemFunction036 OpenProcessToken RegSetValueExW RegOpenKeyExW GetTokenInformation RegQueryValueExW

ws2_32

WSAStartup WSACleanup getaddrinfo send freeaddrinfo connect setsockopt ioctlsocket WSASocketW closesocket WSASend WSAIoctl getsockopt shutdown recv bind getsockname WSAGetLastError getpeername

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtReadFile NtOpenFile NtCreateFile RtlNtStatusToDosError NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

user32

GetSystemMetrics ReleaseDC GetDC GetLastInputInfo

gdi32

DeleteDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits CreateCompatibleDC DeleteObject

crypt32

CryptUnprotectData

psapi

GetModuleFileNameExW

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memmove memcmp memchr strchr strrchr __C_specific_handler memset __current_exception __current_exception_context memcpy

api-ms-win-crt-string-l1-1-0

strlen strcmp strcspn strncmp strspn

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free realloc _msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log __setusermatherr _dclass fabs

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _initterm _initterm_e _set_app_type _exit _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _beginthreadex terminate _endthreadex _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe __p___argv __p___argc exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer

kernel32

advapi32

ws2_32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

gdi32

crypt32

psapi

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic