2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer
Size 3.9MB
Sample260816-e75jxadj8z
SHA256 9460d680650a5b5f8d2e8a9911619cafbe82ddee8ca6c556aa2d89320c711167
MD5 53934c70895b969bc4c800179ae90d5a
SHA1 1b6066ed744931a835fce446af6251acb709f859
SHA512 462ee34e8faca3ad5dfef0bd376b3761bc1f28c71d41517c5bef546f0d33d71b104379d7c187bd169458a462ad7c08f1a6c2a62a8f35123a2d2729592190fdb0
SSDEEP 49152:JgmsB3hCUxUpmkYtbgR+O/AheTpxBDwAoq6ePBusM999ia0XfQSjwuzatSEYR21j:JFsBVdvo9cyUsU16vZz7t+
TLSH
T1F2167C43F69581E9C09EC178C72B9233EB72BC8D4630B79B2AD44A612F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer

File Explorer

2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer

.exe 3.9MB

2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer

IMPHASH 903edfce35e8996397a5c4ac989b2f24
SHA256 9460d680650a5b5f8d2e8a9911619cafbe82ddee8ca6c556aa2d89320c711167
MD5 53934c70895b969bc4c800179ae90d5a
SHA1 1b6066ed744931a835fce446af6251acb709f859
SHA512 462ee34e8faca3ad5dfef0bd376b3761bc1f28c71d41517c5bef546f0d33d71b104379d7c187bd169458a462ad7c08f1a6c2a62a8f35123a2d2729592190fdb0
SSDEEP 49152:JgmsB3hCUxUpmkYtbgR+O/AheTpxBDwAoq6ePBusM999ia0XfQSjwuzatSEYR21j:JFsBVdvo9cyUsU16vZz7t+
TLSH
T1F2167C43F69581E9C09EC178C72B9233EB72BC8D4630B79B2AD44A612F57B605F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2854120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

newwapcu.pdb

crypt32

CryptUnprotectData CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore

kernel32

CloseHandle FindClose GetFileInformationByHandleEx GetLastError SetFileInformationByHandle SwitchToThread OpenProcess Process32Next Process32First SetFileAttributesW GetCurrentProcess GetModuleHandleW GetProcAddress CreateMutexW IsDebuggerPresent GetCurrentProcessId GlobalMemoryStatusEx GetTickCount64 GlobalLock GlobalUnlock GlobalSize LocalFree GetConsoleWindow CreateToolhelp32Snapshot AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetTimeZoneInformationForYear GetProcessHeap HeapFree HeapReAlloc SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemInfo GetFileInformationByHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep SetFilePointerEx FindNextFileW PostQueuedCompletionStatus LoadLibraryExA InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile FlushFileBuffers HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection MapViewOfFile GetTickCount CreateFileMappingW HeapDestroy

ntdll

NtQueryInformationProcess NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile NtDeviceIoControlFile

ws2_32

ioctlsocket WSASocketW WSASend shutdown getsockopt bind WSAStartup WSACleanup freeaddrinfo recv setsockopt getaddrinfo WSAIoctl getsockname getpeername closesocket WSAGetLastError connect send

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

GetTokenInformation AdjustTokenPrivileges DuplicateTokenEx RegOpenKeyExW RevertToSelf LookupPrivilegeValueA OpenProcessToken SetThreadToken RegEnumValueW RegEnumKeyExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey

secur32

QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage ApplyControlToken InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage FreeCredentialsHandle DeleteSecurityContext

bcryptprimitives

ProcessPrng

oleaut32

SysStringLen SysFreeString GetErrorInfo VariantClear SysAllocStringLen

user32

MessageBoxW GetCursorPos ShowWindow GetWindowLongPtrW SetWindowLongPtrW SendMessageTimeoutW CloseClipboard GetSystemMetrics GetClipboardData GetDesktopWindow GetWindowDC ReleaseDC OpenClipboard EnumClipboardFormats SetWindowPos

ole32

CoInitializeEx CoCreateInstance CoUninitialize

gdi32

DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC GetDIBits

vcruntime140

memmove __current_exception_context memset __CxxFrameHandler3 __current_exception memcmp memchr strchr strrchr memcpy __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen strcmp strcspn strncmp strspn

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass log fabs __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _initialize_onexit_table __p___argv _get_initial_narrow_environment __p___argc _initialize_narrow_environment _crt_atexit terminate _cexit _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _endthreadex _beginthreadex _register_onexit_function _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer

crypt32

kernel32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

advapi32

ncrypt

secur32

bcryptprimitives

oleaut32

user32

ole32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic