Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe
- Size 18.4MB
- Sample260817-jrl5vaab98
- SHA256 7287a53f28c9c9063fb16d1f042361099cb625b880efac051a8f846e01f41ab8
- MD5 5ef26b8b3cf1e6b1488046a9410aa560
- SHA1 9991a14300760bd865429f2745fccb1128e1bde6
- SHA512 747966daec01dac1d68bdc748a9f4c098859162e3c2b509c3ca896de47f05a5a65173afd5bbba61a3728800a244a5d854a31c94e62bcb7e7c8e345eb07c486b3
- SSDEEP 98304:/H4I1+80nGB7kGsY2Rr2U9NigpxmL7L89JeeQLZARYhRBsgQP4N82qbIIfVBfbgE:/H4uDNJeKZARSB/QgN82qbIIf7cnnX8
- TLSH T1ED177B52BA5A54EDD46AC07483468633AB3174DB0B34BAEF49D486792F6AFE01F3C704
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ku.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDREQL.ICO.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Notifications\SoftLandingAssetDark.gif.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\PREVIEW.GIF.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\UnknownErrorIllustration.theme-dark.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySplashScreen.scale-200.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\PREVIEW.GIF.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityMedTile.scale-200_contrast-white.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\VisualElements\SmallLogoBeta.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityAppList.targetsize-96.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityMedTile.scale-100.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\dd_arrow_small.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\.NETFramework\0000\corperfmonsymbols_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NETFramework\0407\corperfmonsymbols_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\LSM\0411\lagcounterdef.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\MSDTC\0409\msdtcprf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\MSDTC Bridge 3.0.0.0\0407\_TransactionBridgePerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-400.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NET Memory Cache 4.0\0C0A\netmemorycache_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\SMSvcHost 4.0.0.0\0C0A\_SMSvcHostPerfCounters_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGatherer\0409\gsrvctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\usbhub\0411\usbperf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\MSDTC Bridge 3.0.0.0\0000\_TransactionBridgePerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\rdyboost\0407\ReadyBoostPerfCounters.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\RemoteAccess\040C\rasctrs.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\_TransactionBridgePerfCounters_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.EaseOfAccess.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\TAPISRV\0000\tapiperf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGatherer\0410\gsrvctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGTHRSVC\0C0A\gthrctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\IdentityCRL\WLive48x48.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\Extras.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NETFramework\040C\corperfmonsymbols_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\usbhub\040C\usbperf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\Globalization\Ink\en-US\configuration.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-white.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGatherer\0411\gsrvctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\usbhub\0407\usbperf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.contrast-black.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\ESENT\0409\esentprf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0C0A\_ServiceModelEndpointPerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\Boot\BootDebuggerFiles.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-200.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\Outlook\outlperf.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-150.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_contrast-white.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NET CLR Data\0000\_DataPerfCounters_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\ServiceModelOperation 3.0.0.0\0411\_ServiceModelOperationPerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGTHRSVC\0410\gthrctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.AppsRtl.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\.NET Data Provider for SqlServer\0411\_dataperfcounters_shared12_neutral_d.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\SMSvcHost 3.0.0.0\0407\_SMSvcHostPerfCounters_D.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\INF\UGTHRSVC\040C\gthrctr.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-100.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-400.png.rustlock 2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_5ef26b8b3cf1e6b1488046a9410aa560_akira_coinminer_glassworm_poet-rat_rusty-stealer.exe"1⤵
- Creates a file in the Startup directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5772