2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer
Size 60.9MB
Sample260813-mcaeaaxcpe
SHA256 41a000a6cc57ca74b1c4cfd61eb43fc559ed9f7b6ad0f8f96168b26d38153ca3
MD5 21918c8534e720ee4b6b7e2c5a61fd8c
SHA1 ee4085020488e3ba32850f4cd5843ec86e5c80fc
SHA512 c80f1c78687b0e862bf0c8f66e43486c164b505c63f238d8f8562e691a67cba8be773bebb9310df2d3880b96841ee2d9301c032fdc43afa07a28a4d11cea2ed7
SSDEEP 786432:DNV4RV3MRq4NR4RN1/2ogihYfwgGMRC/xMalj5afVPm0fn00z:DwRSRq4NORDuoDYfPtOMKjyZP0A
TLSH
T10EE701C3E29480EED0CFC670D71BA677EBB278995424B14F1BC4AE112E6AF019748B75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer

File Explorer

2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer

.exe 60.9MB

2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer

IMPHASH 12a9bcb37ff61f0c1a7225bf2e46099c
SHA256 41a000a6cc57ca74b1c4cfd61eb43fc559ed9f7b6ad0f8f96168b26d38153ca3
MD5 21918c8534e720ee4b6b7e2c5a61fd8c
SHA1 ee4085020488e3ba32850f4cd5843ec86e5c80fc
SHA512 c80f1c78687b0e862bf0c8f66e43486c164b505c63f238d8f8562e691a67cba8be773bebb9310df2d3880b96841ee2d9301c032fdc43afa07a28a4d11cea2ed7
SSDEEP 786432:DNV4RV3MRq4NR4RN1/2ogihYfwgGMRC/xMalj5afVPm0fn00z:DwRSRq4NORDuoDYfPtOMKjyZP0A
TLSH
T10EE701C3E29480EED0CFC670D71BA677EBB278995424B14F1BC4AE112E6AF019748B75
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45933437

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapSize

bcryptprimitives

ProcessPrng

advapi32

EventSetInformation

ntdll

NtCreateFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress

user32

PostThreadMessageW

comctl32

DefSubclassProc

ole32

CoTaskMemFree

shlwapi

SHCreateMemStream

shell32

DragFinish SHOpenFolderAndSelectItems

gdi32

CreateDIBSection

dwmapi

DwmSetWindowAttribute

oleaut32

GetErrorInfo

ws2_32

freeaddrinfo

secur32

AcquireCredentialsHandleA

crypt32

CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-heap-l1-1-0

_msize

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

10.3MB

Virtual Size

10.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

294KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp00

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp01

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp02

Size

27.1MB

Virtual Size

27.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

174KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_21918c8534e720ee4b6b7e2c5a61fd8c_akira_glassworm_rusty-stealer

kernel32

bcryptprimitives

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

user32

comctl32

ole32

shlwapi

shell32

gdi32

dwmapi

oleaut32

ws2_32

secur32

crypt32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic