e21b4efd0d901d02e3e441d32c380fe1169ed4bd32a3f2b7db81a94ae3ef969d

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:22

Target
2026-08-08_f92b77d5bc06cd6ff48c28bae3c5ba43_akira_glassworm_rusty-stealer.exe
Size 11.8MB
Sample260808-ctsxva1thw
SHA256 e21b4efd0d901d02e3e441d32c380fe1169ed4bd32a3f2b7db81a94ae3ef969d
MD5 f92b77d5bc06cd6ff48c28bae3c5ba43
SHA1 c2bf3904c116ec31ed3bc04a50052c3675759c09
SHA512 c154b5be02000e1294c333e8be34bcadc571dedd0b428c8dd792ab5e7e1be94e864adfa3427fc7332541ecb505c11d29bdc5c37b85c6c4cdec475f7c2951aabe
SSDEEP 98304:j1pVyFXJj0dy4T7jhU/lDpxAMka3iZWCOmehF4ZBPpxE3Vme:ppAFXau/l8Ra37b4ZT
TLSH
T1C9C60821BB5B99ACD09BC474834B4A624A7130CB0B35B9FF449496382F6EBF45F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3596	taskkill.exe
1476	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3596	2716	2026-08-08_f92b77d5bc06cd6ff48c28bae3c5ba43_akira_glassworm_rusty-stealer.exe	88
PID 2716 wrote to memory of 1476	2716	2026-08-08_f92b77d5bc06cd6ff48c28bae3c5ba43_akira_glassworm_rusty-stealer.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f92b77d5bc06cd6ff48c28bae3c5ba43_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f92b77d5bc06cd6ff48c28bae3c5ba43_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM selfior-backend-x86_64-pc-windows-msvc.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM selfior-backend.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1476