2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer
Size 832KB
Sample260809-t31gqaak2x
SHA256 3f740817181376036294a75fd3f1f81950611b5160b656b68239c58ceb576f5d
MD5 72daca1ca43b79c941cb294202d52e82
SHA1 51e46ad7226ead2662f6410cebe08217a048f629
SHA512 18b6122229f92adf5c758bb23c6eecb047a8b8a7f5613edc936383a177e1fe365833fe9af1121cfab3c40ef946cdab315916137f9fb3f82d49ea4c8748c3ad8f
SSDEEP 12288:K6R7ZX0DzV7GKHYmQxdHMD/B+CsZP0wH+l2SZ:K6RNkDNGKYDH287ZPdI
TLSH
T162056A03E29981EDD55EC07CC3979536AA63B89E0A31B2EF27D41B243E67E916F1D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer

File Explorer

2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer

.exe 832KB

2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer

IMPHASH 5243d50051dd0aa53a4a5e7cac4238a1
SHA256 3f740817181376036294a75fd3f1f81950611b5160b656b68239c58ceb576f5d
MD5 72daca1ca43b79c941cb294202d52e82
SHA1 51e46ad7226ead2662f6410cebe08217a048f629
SHA512 18b6122229f92adf5c758bb23c6eecb047a8b8a7f5613edc936383a177e1fe365833fe9af1121cfab3c40ef946cdab315916137f9fb3f82d49ea4c8748c3ad8f
SSDEEP 12288:K6R7ZX0DzV7GKHYmQxdHMD/B+CsZP0wH+l2SZ:K6RNkDNGKYDH287ZPdI
TLSH
T162056A03E29981EDD55EC07CC3979536AA63B89E0A31B2EF27D41B243E67E916F1D304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

571408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winupdate.pdb

kernel32

GetSystemTimeAsFileTime SetFileCompletionNotificationModes GetCurrentThreadId GetCurrentProcess WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetQueuedCompletionStatusEx WaitForSingleObject HeapAlloc GetFinalPathNameByHandleW IsProcessorFeaturePresent SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetProcAddress CreateWaitableTimerExW SetWaitableTimer Sleep ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult InitializeSListHead CreateIoCompletionPort IsDebuggerPresent UnhandledExceptionFilter SwitchToThread GetModuleHandleW HeapReAlloc HeapFree CancelIoEx GetProcessHeap GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter GetModuleFileNameW SetLastError LocalFree CreateFileW FindFirstFileExW CloseHandle GetLastError FindClose FindNextFileW SetUnhandledExceptionFilter

crypt32

CertFreeCertificateContext CertGetCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptUnprotectData

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASend WSASocketW closesocket ioctlsocket connect recv getsockopt setsockopt bind WSAStartup WSACleanup WSAIoctl getaddrinfo freeaddrinfo send getpeername getsockname WSAGetLastError shutdown

ntdll

NtCancelIoFileEx NtReadFile RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile

bcrypt

BCryptGenRandom

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey SystemFunction036

secur32

EncryptMessage DeleteSecurityContext FreeContextBuffer AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleA InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle

bcryptprimitives

ProcessPrng

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset memmove memcpy __CxxFrameHandler3 memcmp

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc _configure_narrow_argv __p___argv exit _initialize_narrow_environment _initterm_e _c_exit _set_app_type _register_thread_local_exe_atexit_callback _initterm _seh_filter_exe _cexit _initialize_onexit_table _get_initial_narrow_environment terminate _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_72daca1ca43b79c941cb294202d52e82_akira_glassworm_rusty-stealer

kernel32

crypt32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

secur32

bcryptprimitives

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic