2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer
Size 2.9MB
Sample260809-vg7vcabe38
SHA256 378068d761217f35f1f0dbb74dfa55fd39f2d865db004a83e04bbf6ade1f3fb6
MD5 3cee9251f7c8b62a008da420f59c3ad3
SHA1 3ee2df4855ef1fe90bc67d8362ee258e9a64cdb9
SHA512 4593f8b7b9ce898c14a2f4bec0cd578059d8a1ef38217cfc9d7bafdc46aa2c9e2dade49415dda8bf4959263d9d48a4fe7a16d8bf6964f8b1801942be2847e025
SSDEEP 49152:nFnlm7ZUvmNbdJ2tkIOlSzG+PRZbwpPqRfr/:67otRZapCx
TLSH
T16CE53A616A5B99ACD55AC470C3468A735A2130DB0B36B9FF44C496383F6ABF16F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer

File Explorer

2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer

.exe 2.9MB

2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer

IMPHASH 0bdf83d3510fbf718f8fe31c98f39d18
SHA256 378068d761217f35f1f0dbb74dfa55fd39f2d865db004a83e04bbf6ade1f3fb6
MD5 3cee9251f7c8b62a008da420f59c3ad3
SHA1 3ee2df4855ef1fe90bc67d8362ee258e9a64cdb9
SHA512 4593f8b7b9ce898c14a2f4bec0cd578059d8a1ef38217cfc9d7bafdc46aa2c9e2dade49415dda8bf4959263d9d48a4fe7a16d8bf6964f8b1801942be2847e025
SSDEEP 49152:nFnlm7ZUvmNbdJ2tkIOlSzG+PRZbwpPqRfr/:67otRZapCx
TLSH
T16CE53A616A5B99ACD55AC470C3468A735A2130DB0B36B9FF44C496383F6ABF16F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2045740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spyware.pdb

crypt32

CryptProtectData CryptUnprotectData CertDuplicateCertificateContext CertDuplicateStore CertFreeCertificateContext CertCloseStore CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

kernel32

SetFileCompletionNotificationModes WaitForSingleObject CreateIoCompletionPort CreateThread GetQueuedCompletionStatusEx SetLastError IsDebuggerPresent CancelIoEx ReadFile WriteFile GetModuleHandleW PostQueuedCompletionStatus GetOverlappedResult GetFinalPathNameByHandleW GetCurrentThreadId GetCurrentProcess WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP Sleep CreateFileW SwitchToThread ReadFileEx SleepEx WriteFileEx GetModuleHandleA HeapReAlloc SetHandleInformation GetFullPathNameW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetCurrentThread WaitForMultipleObjects GetExitCodeProcess SetThreadStackGuarantee SetFileInformationByHandle DeleteFileW UnhandledExceptionFilter GetSystemInfo LocalFree WriteConsoleW FormatMessageW GetSystemTimeAsFileTime HeapAlloc GetLastError GetCommandLineW IsProcessorFeaturePresent AddVectoredExceptionHandler GetProcAddress CloseHandle GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW RtlVirtualUnwind WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal HeapFree GetProcessHeap InitializeSListHead SetUnhandledExceptionFilter

advapi32

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegOpenKeyExW RegCloseKey RegQueryValueExW

oleaut32

SysStringLen VariantClear GetErrorInfo SafeArrayUnaccessData SafeArrayAccessData SysAllocStringLen SysFreeString SafeArrayDestroy

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ws2_32

WSASend connect shutdown send getsockname WSAGetLastError getpeername closesocket bind WSAIoctl setsockopt ioctlsocket WSASocketW WSAStartup WSACleanup recv getaddrinfo getsockopt freeaddrinfo

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile NtReadFile NtOpenFile NtCancelIoFileEx NtCreateFile

secur32

ApplyControlToken AcquireCredentialsHandleA AcceptSecurityContext DecryptMessage EncryptMessage InitializeSecurityContextW FreeCredentialsHandle DeleteSecurityContext FreeContextBuffer QueryContextAttributesW

ole32

CoInitializeSecurity CoCreateInstance CoInitializeEx CoSetProxyBlanket

vcruntime140

__CxxFrameHandler3 memcmp memset memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context memcpy

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe terminate _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _configure_narrow_argv _initterm_e exit _register_onexit_function _initialize_onexit_table __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _initterm _exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_3cee9251f7c8b62a008da420f59c3ad3_akira_glassworm_rusty-stealer

crypt32

kernel32

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ws2_32

ntdll

secur32

ole32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic