2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer
Size 9.4MB
Sample260814-2q7dhatbjc
SHA256 391825f67d6d97a27a29beff3410d62aabb5dd75c24ceeb477787052d5b9538c
MD5 eb45924c85bf1dec1209963a82cbc237
SHA1 39830d4d459517fd5e936d9ea69a6c1def518039
SHA512 fa7a64df33fe85a0aa646089af357ccaa16b8482ee9a4d6b2c872bf7991589132201236cebd8e05e6813a1420d54314ea2dc9fe53186be44b8bd37906959a2ab
SSDEEP 98304:5LkHvdj6fdoFTAMGGKuYrfugK/zc+6kOK6o7wRGpj3:5LYodpfhkOAF9
TLSH
T16AA64B12BB9A55ECC19AC474834646729A3170CB0B34BAFF45D486393F6AAF11F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer

.exe 9.4MB

2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer

IMPHASH bcdbf0e0628f56520162ee5e738298ec
SHA256 391825f67d6d97a27a29beff3410d62aabb5dd75c24ceeb477787052d5b9538c
MD5 eb45924c85bf1dec1209963a82cbc237
SHA1 39830d4d459517fd5e936d9ea69a6c1def518039
SHA512 fa7a64df33fe85a0aa646089af357ccaa16b8482ee9a4d6b2c872bf7991589132201236cebd8e05e6813a1420d54314ea2dc9fe53186be44b8bd37906959a2ab
SSDEEP 98304:5LkHvdj6fdoFTAMGGKuYrfugK/zc+6kOK6o7wRGpj3:5LYodpfhkOAF9
TLSH
T16AA64B12BB9A55ECC19AC474834646729A3170CB0B34BAFF45D486393F6AAF11F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6256176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

warp_updater.pdb

bcryptprimitives

ProcessPrng

kernel32

LoadLibraryExW LoadLibraryW GetModuleHandleA GetModuleHandleW GetOverlappedResult PostQueuedCompletionStatus CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent DuplicateHandle SetFileCompletionNotificationModes InitializeSListHead RtlUnwindEx RtlPcToFileHeader MultiByteToWideChar EncodePointer InitializeCriticalSectionAndSpinCount UnregisterWaitEx TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA FlsAlloc FlsGetValue GetFileInformationByHandle CreateSemaphoreW CancelIo ReleaseSemaphore ReadDirectoryChangesW MoveFileExW GetFileInformationByHandleEx GetFileType FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect SetStdHandle FreeLibraryAndExitThread GetModuleHandleExW DeviceIoControl FindClose FindNextFileW SetFilePointerEx GetSystemTimePreciseAsFileTime QueryPerformanceFrequency SetThreadStackGuarantee FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentDirectoryW GetSystemDirectoryW SetFileAttributesW IsDebuggerPresent CreateDirectoryW RegisterWaitForSingleObject GetStartupInfoW GetCommandLineW SetLastError ExitProcess ExitThread CompareStringW LCMapStringW GetExitCodeProcess SetHandleInformation GetConsoleMode GetCurrentThreadId DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI ReadFile HeapCreate HeapFree GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DeleteFileA DeleteFileW HeapReAlloc HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize GetProcessHeap GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW QueryPerformanceCounter GetTickCount FlushFileBuffers Sleep GetModuleFileNameW SetNamedPipeHandleState CreateFileW IsValidCodePage GetNativeSystemInfo GetSystemInfo GetACP VirtualQuery GetOEMCP GetCPInfo FreeLibrary GetStringTypeW SystemTimeToFileTime CreateMutexA RtlLookupFunctionEntry RtlCaptureContext ReleaseMutex UnmapViewOfFile LoadLibraryA WaitForSingleObjectEx GetCurrentProcessId WideCharToMultiByte MapViewOfFile lstrlenW RtlVirtualUnwind GetProcAddress GetCurrentProcess CloseHandle GetComputerNameExW SwitchToThread SetConsoleCtrlHandler ReadFileEx CreateThread GetWindowsDirectoryW SetFileTime TerminateProcess GetStdHandle AddVectoredExceptionHandler SetFileInformationByHandle GetTimeZoneInformation GetCurrentThread GetEnvironmentVariableW FindFirstFileExW GetFinalPathNameByHandleW SetEnvironmentVariableW SleepEx WriteConsoleW GetConsoleOutputCP WriteFileEx CreateProcessW CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

psapi

GetModuleFileNameExW EnumProcessModules GetModuleInformation

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey SystemFunction036 AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus

user32

GetSystemMetrics

ws2_32

getpeername shutdown getsockopt WSAGetLastError recv WSASend send setsockopt ioctlsocket connect WSAIoctl WSASocketW freeaddrinfo WSACleanup bind WSAStartup getsockname getaddrinfo closesocket

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

NtCreateFile NtReadFile NtCreateNamedPipeFile NtDeviceIoControlFile NtCancelIoFileEx NtOpenFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

612KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_eb45924c85bf1dec1209963a82cbc237_akira_glassworm_icedid_rusty-stealer

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

psapi

advapi32

user32

ws2_32

bcrypt

shell32

combase

ntdll

generic