General
- Target 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer
- Size 7.1MB
- Sample260809-clk72agd34
- SHA256 e6e9f7b234c0c9e0fd4dce723bfd6f0d7284faec65f8eab62ab958675b7fb53b
- MD5 7098d02e92bc0e142028dead3e474928
- SHA1 5221889192ebd8bda84e574a7f851c95a3ce8e57
- SHA512 9bbc2ce9dfed2fa84c39c76ba58caf3320d47d906b51d1c51c785e14d53bd7b4b2e5a84dadbfe93edad1235c081daf6a55a256539e553f85f35aee7d805baa94
- SSDEEP 98304:73Btuoy/Pb+pwVzqv8aps2HQjsQwYn+1d7:7xILLsv8OMs3e
- TLSH T1C2764A027E8A98A9C89DC870C24ACBB30F1138EB1936F5BF15D565252FBE6B51F1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe
Resource
win10v2004-20260513-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe
Resource
win11ltsc2024-20260710-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer
- Size 7.1MB
- SHA256 e6e9f7b234c0c9e0fd4dce723bfd6f0d7284faec65f8eab62ab958675b7fb53b
- MD5 7098d02e92bc0e142028dead3e474928
- SHA1 5221889192ebd8bda84e574a7f851c95a3ce8e57
- SHA512 9bbc2ce9dfed2fa84c39c76ba58caf3320d47d906b51d1c51c785e14d53bd7b4b2e5a84dadbfe93edad1235c081daf6a55a256539e553f85f35aee7d805baa94
- SSDEEP 98304:73Btuoy/Pb+pwVzqv8aps2HQjsQwYn+1d7:7xILLsv8OMs3e
- TLSH T1C2764A027E8A98A9C89DC870C24ACBB30F1138EB1936F5BF15D565252FBE6B51F1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Deletes itself
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2