2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer
Size 3.8MB
Sample260809-va3xtavwdt
SHA256 05973433f1d21dbf6ddfd7fce1d91f682d268aef2a605cd1e4ae3f07a055437f
MD5 589a7e7eb77c8671f10a00c4ee34acb4
SHA1 21e08dc6e67866ac015fa8c6d3c6dff21da25faf
SHA512 0d870da693503debb833c9adb2a022cfc24aca486598ad2711f7c22d0244aa7620185bee969c7ef178bd4d00d080a5dce71374b2e6b363438ef2c1a8df1da6f3
SSDEEP 49152:DAwRRyobnIBfFlV0UegZOOG/a2k42Gxw5HVZgHImGsL5KuCiRCwNofq+:khn4pkfgLGN4CwN
TLSH
T16B06D717E77650E8D4BBC0789257A727BD71389943386BE78A80862A1F21FF4AD3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer

File Explorer

2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer

.exe 3.8MB

2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer

IMPHASH d3a1ce1a0dd2acbdf9dc47dcfc2d6c90
SHA256 05973433f1d21dbf6ddfd7fce1d91f682d268aef2a605cd1e4ae3f07a055437f
MD5 589a7e7eb77c8671f10a00c4ee34acb4
SHA1 21e08dc6e67866ac015fa8c6d3c6dff21da25faf
SHA512 0d870da693503debb833c9adb2a022cfc24aca486598ad2711f7c22d0244aa7620185bee969c7ef178bd4d00d080a5dce71374b2e6b363438ef2c1a8df1da6f3
SSDEEP 49152:DAwRRyobnIBfFlV0UegZOOG/a2k42Gxw5HVZgHImGsL5KuCiRCwNofq+:khn4pkfgLGN4CwN
TLSH
T16B06D717E77650E8D4BBC0789257A727BD71389943386BE78A80862A1F21FF4AD3D344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3148944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stealer.pdb

user32

CloseClipboard GetClipboardData GetMonitorInfoW EnumDisplayMonitors SetClipboardData EmptyClipboard OpenClipboard

kernel32

GetLastError GlobalFree GlobalLock LocalFree CloseHandle IsProcessorFeaturePresent FormatMessageW LoadLibraryExA WaitForSingleObject GetCurrentThreadId AreFileApisANSI HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW LockFile SetFilePointer GetExitCodeThread VirtualAllocEx VirtualFreeEx GetModuleHandleW GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW GlobalAlloc GlobalUnlock CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap FreeLibrary CreateFileMappingW MapViewOfFile GetProcAddress CreateProcessW TerminateProcess CreateFileW CreateNamedPipeW ConnectNamedPipe ReadFile WriteFile FlushFileBuffers SetUnhandledExceptionFilter InitializeSListHead GetStdHandle UnhandledExceptionFilter FindNextFileW GetModuleHandleA WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW ReleaseMutex CreateMutexA SwitchToThread FindClose FindFirstFileExW CopyFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW IsDebuggerPresent GetEnvironmentStringsW GetExitCodeProcess GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetOverlappedResult ReadFileEx CreateEventW CreateThread QueryPerformanceFrequency SetFileTime SetFileInformationByHandle SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA MultiByteToWideChar OutputDebugStringW GetSystemInfo SystemTimeToFileTime WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter GetTickCount Module32NextW Module32FirstW CreateToolhelp32Snapshot WriteProcessMemory

gdi32

DeleteDC SelectObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetDIBits DeleteObject CreateDCW

crypt32

CryptUnprotectData

oleaut32

SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile NtCreateThreadEx NtReadFile RtlNtStatusToDosError

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

vcruntime140

__current_exception_context strchr __CxxFrameHandler3 memchr strrchr __C_specific_handler memcpy memcmp _CxxThrowException memset memmove __current_exception

api-ms-win-crt-string-l1-1-0

strcspn strcmp strlen strspn strncmp

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc _msize free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

fabs log __setusermatherr _dclass

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initterm_e _set_app_type exit _endthreadex _beginthreadex _exit __p___argc _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _cexit _seh_filter_exe _c_exit __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_589a7e7eb77c8671f10a00c4ee34acb4_akira_glassworm_rusty-stealer

user32

kernel32

gdi32

crypt32

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic