2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer
Size 3.0MB
Sample260808-c8faas1xft
SHA256 1f84b5ce8b6b24e6b886e767b44673f498e1b8f3380cc4d438a55fc3ed90037a
MD5 c9618e5b85637f3207a01815291cd2fb
SHA1 3414402b13e2c3b766b703a945ce2107728f5b3b
SHA512 66beaa069d0676e6299cb6c5a7fba66084730e5545b42ea29bda6a57846b7f815928399c2f825644c1d35f2853ff2dff096f7c4ff0b1bbca08de949585785d32
SSDEEP 49152:JFZQqbqGNnHlX1rrqzUYRz2+xP+ACDCIZdrULaPFUpB8T+4IU6i:brN54zVhcHC7TH+
TLSH
T192E55C02BA9B94ECC15AC4B5C3464A736E2174CB1B26B9FF41D496383E6ABF05B3C705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer

File Explorer

2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer

.exe 3.0MB

2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer

IMPHASH cb32d54b282fb8c785b6670e167853dd
SHA256 1f84b5ce8b6b24e6b886e767b44673f498e1b8f3380cc4d438a55fc3ed90037a
MD5 c9618e5b85637f3207a01815291cd2fb
SHA1 3414402b13e2c3b766b703a945ce2107728f5b3b
SHA512 66beaa069d0676e6299cb6c5a7fba66084730e5545b42ea29bda6a57846b7f815928399c2f825644c1d35f2853ff2dff096f7c4ff0b1bbca08de949585785d32
SSDEEP 49152:JFZQqbqGNnHlX1rrqzUYRz2+xP+ACDCIZdrULaPFUpB8T+4IU6i:brN54zVhcHC7TH+
TLSH
T192E55C02BA9B94ECC15AC4B5C3464A736E2174CB1B26B9FF41D496383E6ABF05B3C705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2229228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

webview2.pdb

kernel32

GetTickCount64 GetProcessHeap GlobalMemoryStatusEx GetComputerNameExW GetProcAddress SetLastError LoadLibraryA HeapAlloc SetHandleInformation GetModuleHandleA GetSystemDirectoryW GetModuleHandleW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle LoadLibraryExW FreeLibrary GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime CloseHandle HeapFree HeapReAlloc GetLastError GetSystemInfo FindNextFileW MoveFileExW CopyFileExW SwitchToThread DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetFileAttributesW CreateProcessW CompareStringOrdinal ReadFile GetOverlappedResult CancelIo CreateEventW ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW FormatMessageW WriteFileEx UnhandledExceptionFilter ReadFileEx GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle WideCharToMultiByte RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetCurrentProcess FreeEnvironmentStringsW CreateMutexW IsDebuggerPresent QueryFullProcessImageNameW TerminateProcess SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead SleepEx GetEnvironmentStringsW FindClose Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter SetThreadExecutionState CreateThread CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess

secur32

AcquireCredentialsHandleA FreeCredentialsHandle ApplyControlToken EncryptMessage QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext DecryptMessage DeleteSecurityContext

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertGetCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateStore CertOpenStore CertEnumCertificatesInStore

ntdll

NtResumeProcess NtSuspendProcess NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

advapi32

GetTokenInformation SystemFunction036 OpenProcessToken RegCreateKeyExW RegSetValueExW GetUserNameW

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

recv closesocket setsockopt WSAGetLastError send getsockname ioctlsocket connect select WSAStartup WSACleanup WSASocketW WSADuplicateSocketW WSASend freeaddrinfo getaddrinfo getpeername WSARecv getsockopt

shell32

ShellExecuteW

user32

SendMessageW keybd_event ShowWindow SetProcessDPIAware GetDC GetLastInputInfo mouse_event GetForegroundWindow GetAsyncKeyState SetCursorPos GetSystemMetrics GetWindowThreadProcessId GetWindowTextW IsWindowVisible EnumWindows BlockInput

gdi32

DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits

vcruntime140

__C_specific_handler _CxxThrowException memcmp __current_exception_context memcpy __CxxFrameHandler3 memset memmove __current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _get_initial_narrow_environment _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _seh_filter_exe _exit terminate exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_c9618e5b85637f3207a01815291cd2fb_akira_glassworm_rusty-stealer

kernel32

secur32

crypt32

ntdll

bcryptprimitives

advapi32

bcrypt

api-ms-win-core-synch-l1-2-0

ws2_32

shell32

user32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic