Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 17:40

General

  • Target
    2026-08-15_c1165519430c253c6f0a78c2e1c9b4d3_akira_glassworm_rusty-stealer.exe
  • Size 5.8MB
  • Sample260815-v8xtfs1wdv
  • SHA256 6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_c1165519430c253c6f0a78c2e1c9b4d3_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_c1165519430c253c6f0a78c2e1c9b4d3_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:5724
    • C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
      "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\system32\reg.exe
        "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1540
      • C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
        "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 4748
        3⤵
        • Executes dropped EXE
        PID:6052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        agent.db

        • Path C:\Users\Admin\AppData\Local\Bridge\agent.db
        • Size 60KB
        • SHA256 438dc69dbf234f325b0f27fd7aff0597a65a1f94479f0898ccf085f5870d3194
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 4KB
        • SHA256 8438857a411152665c320f1a0396bc483e4b27bf06ce0feedf823c426f627630
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 1KB
        • SHA256 0451f95f1eff0b910d471eae9d55aaa821d80856e62d4ce1e09d41db95776948
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 1KB
        • SHA256 fbbdddc28c2dbb7ceb41669292cf133cbae1b4f22d7336b2df072c09e2b2ff9c
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 2KB
        • SHA256 bba7afce7ca0218a82f18761d9eba2eef9ec4fd4f594f690a2439e580d54f33d
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 699B
        • SHA256 52b85751e8b9a50a4d4f3b2e3a9302047c6b92e4ea011320ae197a5b31628525
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 2KB
        • SHA256 899a19020b8eea19fba523b44a4c6ae0d9280f1746f908e6acf93c0540e1a77e
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 2KB
        • SHA256 6ed5d62ab588b8cab9c36e5519c52912e8f87ddcbf825f5481041d747141cc73
        • MD5 SHA1 SHA512 TLSH

        bridge-agent.log

        • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
        • Size 3KB
        • SHA256 9a80ba40cae57b538cdaec52921049eb5d69dce77252fd067007b056430d7f0f
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 856e8822a209a77419442da014f1fd18eadfaa7c6445b8d520f1d0ae88aef19a
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 117B
        • SHA256 7487ea751a7350745502f70f1b4b82259c38282b3b1f42e8aa28cad3a707e207
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 f5c0c29505623505a886e8d729d90e64f6f1ca132c65003f1d6b255899fbbf56
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 c185d6cd44be23d8dd58bdfc02055602c6620aa449377da0df2876b5b0261acb
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 c948e88c9040c41a00670966e93267c507444a5d0b412ab5e53c741c6a7715d2
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 1393b60d74a7b873f0336b92c36367cc2f200b9a570106baf59ba131cda2b655
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 b6c6c442c7bdb63a0a08d08520f5de8949ca492134234684f68e4e2e31a26326
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 28aee3817928571f7c314b172ab8fb74a254123edb73f9c31a640d45e70f1f72
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 01a048c682da8894a9a91603d3ae56d05433d522c60a1e49bc1561f8b5a5cdf2
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 eb50aa4fe64f54a6b0231f94f1adb06893ab3f4eb866eddf94287c6c2954be94
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 615e47418ba2d14a36a28a41085fa4a39630ee7b07fa058fdb5feeb791719fc5
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 56399550058067bd2c32deb535873f9816cfe00cce1e96c37543f973c759eebe
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 29e39119d5fa2cec4d591fff28a04e31d433b498f279b3b8d6f35ada1ffc9076
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 4d1957884e3199a146e5c1f536271d6614dce38135183682cea347c60ac3997a
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 04c5dce1d9f8fa0dd27543e2fbabff3273423f27bda7eb34ea7e3e8c547666b1
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 a01145ee5d763b9195208863b6228a3df7ea8f3d72091d8f0300713e28c13714
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 739d6b2fcba2c0daafdb89b017e245e5fe1f6505c6a34944460f6d6ad6c97270
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 24ba57ccc79f3d555fd0031c0357e59ce3d8f250c904091b391970ee97168a89
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 c07c5a21b13cb4bf47afbcd54b8ea712b9c2451d8d15b448200634da6b94bc88
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 db03313b345ba496ed142e822dc9f3d80e36409461533d890306f870d0b64e4b
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 d61e34f680f1e382fbe67235769a8c567962bbf5d89bdcb1c48d19870e02dae8
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 24a24cd3e199a320e7a3a7e118c5b0b494d94aa26dfc5c9047b39ae12d47fc83
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 a3c1604710aa1c39fc4e49aabd136b06f75c7cc4da271040aeee0bfa7856faee
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 f80aa1fdbc9c16d79b8f2216102c2114734aa683e4d10d89d5f80d38a5c99d49
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 4d62240e0f0d039a9ae352b5e2b102612a7f99399f2d13e72c0a276657af6b20
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 1a76416c06d3748d987b000b5a7965d6072d2c0a3f0e35a02d32caf2a081c1d6
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 aa0434ad54a6f36cd9b42dca4de56a94b270849db2d5a054750b833ed5e76a48
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 69c184a89e55b84a72fae53934effdd2b26e0205b3d31b9b10986108d7f4c34e
        • MD5 SHA1 SHA512 TLSH

        supervisor.heartbeat.json

        • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
        • Size 123B
        • SHA256 e17fc6b85c6aaa5021c10f97e7fdd25669f4cddf3bed638ebfc342783f7c25bc
        • MD5 SHA1 SHA512 TLSH

        BridgeAgent.exe

        • Path C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
        • Size 5.8MB
        • SHA256 6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853
        • MD5 SHA1 SHA512 SSDEEP TLSH