2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer
Size 4.5MB
Sample260809-he7ekswtes
SHA256 898ab810bb87a883e4d23d08bdefdb9609b751ad4c7e0594872e704eff944328
MD5 8c8ebd74a0d7c4663f56043b5ea9a4db
SHA1 07b8cbfeee465f0e2fa7a2e394c5bfcb460e92b0
SHA512 7607511167ed4ebe39b2e2fccfa775be77eb867127887bd0cdd89fccdfe3e5e6f7f862da6e7b0a084fbc95fd97e10b3a7f40a35736d05e61a1dc7113c038ea50
SSDEEP 49152:PMreosPIm6gPzpEuEp7R3K5uX3kFNMLbK6o5h56w0J83qnnN6ncQI0yUY6DV7pIB:PVAnqsR6f1T6stA+Pr
TLSH
T1B9264A16BB9A95ECC09AC474834647736A31B4CA0B34BAFB45D492353F6AEF01F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer

File Explorer

2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer

.exe 4.5MB

2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer

IMPHASH 18a7ca73cce31b9f542e96e070d96d44
SHA256 898ab810bb87a883e4d23d08bdefdb9609b751ad4c7e0594872e704eff944328
MD5 8c8ebd74a0d7c4663f56043b5ea9a4db
SHA1 07b8cbfeee465f0e2fa7a2e394c5bfcb460e92b0
SHA512 7607511167ed4ebe39b2e2fccfa775be77eb867127887bd0cdd89fccdfe3e5e6f7f862da6e7b0a084fbc95fd97e10b3a7f40a35736d05e61a1dc7113c038ea50
SSDEEP 49152:PMreosPIm6gPzpEuEp7R3K5uX3kFNMLbK6o5h56w0J83qnnN6ncQI0yUY6DV7pIB:PVAnqsR6f1T6stA+Pr
TLSH
T1B9264A16BB9A95ECC09AC474834647736A31B4CA0B34BAFB45D492353F6AEF01F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3209856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clud_block_bad_cmd.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitializeConditionVariable InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent K32GetPerformanceInfo LoadLibraryA LocalFree LockFileEx MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetThreadAffinityMask SetThreadInformation SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess UnhandledExceptionFilter VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

ntdll

NtCreateNamedPipeFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send

bcryptprimitives

ProcessPrng

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA

oleaut32

GetErrorInfo

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhEnumObjectsA PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

ole32

CoTaskMemFree

shell32

CommandLineToArgvW SHGetKnownFolderPath

psapi

GetModuleFileNameExW GetProcessMemoryInfo

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_init_in_situ _Mtx_lock _Mtx_unlock

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf _set_fmode fflush fputs fwrite putchar

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _callnewh _set_new_mode calloc free malloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf cosf erff exp2f expf expm1f floor floorf log2 log2f logf lroundf pow powf roundf sinf sqrtf tanhf truncf

api-ms-win-crt-string-l1-1-0

memset strcmp wcslen

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy memcmp memcpy memmove

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

522KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

197B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_8c8ebd74a0d7c4663f56043b5ea9a4db_akira_glassworm_rusty-stealer

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

bcryptprimitives

advapi32

oleaut32

pdh

powrprof

ole32

shell32

psapi

msvcp140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

vcruntime140

api-ms-win-crt-locale-l1-1-0

generic