2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer
Size 1.6MB
Sample260820-alrnpscl2v
SHA256 b9ec00ae3ad5314760fa280005cc7375203b27aa9a87bf0ccf1dc645992073b7
MD5 65cee9be9cce9240e67782ffd37bc2bc
SHA1 e4626db11df963287fc9bf670c93f0e32fbc2b4a
SHA512 8c23a4c71f5ef969d0c733c6aec27e4cc5e88b1d8599cacdf68ced4c14a928450f4b78ad79c8564a474483710386cdd35dce9a345f6a50e32f0f35809b6a7846
SSDEEP 24576:pb0wzekaM+NNkV3TczxbF5eO35PDil2zZuk22agfzoCOCfgMaluTavP:10wykX4Nm0h5eOhiEzwYboMaUmX
TLSH
T1BD859E03F6A840EDD59BC178C6165617EBB3B88A1630A7DF12E45BA93F27EA11F1D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer

File Explorer

2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer

.exe 1.6MB

2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer

IMPHASH 869517c9d81a9c832adc6aa5d62f27b6
SHA256 b9ec00ae3ad5314760fa280005cc7375203b27aa9a87bf0ccf1dc645992073b7
MD5 65cee9be9cce9240e67782ffd37bc2bc
SHA1 e4626db11df963287fc9bf670c93f0e32fbc2b4a
SHA512 8c23a4c71f5ef969d0c733c6aec27e4cc5e88b1d8599cacdf68ced4c14a928450f4b78ad79c8564a474483710386cdd35dce9a345f6a50e32f0f35809b6a7846
SSDEEP 24576:pb0wzekaM+NNkV3TczxbF5eO35PDil2zZuk22agfzoCOCfgMaluTavP:10wykX4Nm0h5eOhiEzwYboMaUmX
TLSH
T1BD859E03F6A840EDD59BC178C6165617EBB3B88A1630A7DF12E45BA93F27EA11F1D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1292460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

backup_tool.pdb

bcryptprimitives

ProcessPrng

kernel32

UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile ReadFile AreFileApisANSI GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetModuleHandleA GetProcAddress GetSystemInfo AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc GetFileAttributesExW CreateFileA lstrlenW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA WideCharToMultiByte RtlVirtualUnwind DeleteFileA MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetSystemTimePreciseAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection UnlockFile LocalFree LockFileEx GetFileSize FreeLibrary FlushFileBuffers CreateIoCompletionPort UnregisterWaitEx TerminateProcess PostQueuedCompletionStatus CreateDirectoryW FindNextFileW CopyFileExW GetTempPathW CreateThread DuplicateHandle GetFileAttributesW CreateProcessW GetExitCodeProcess GetFileInformationByHandle FindFirstFileExW SetFileTime CreateFileW GetFullPathNameW WriteFileEx SleepEx ReadFileEx WriteConsoleW WaitForSingleObject IsProcessorFeaturePresent GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentProcess GetCurrentThreadId Sleep GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError UnhandledExceptionFilter GetCurrentThread SetThreadStackGuarantee SwitchToThread SetUnhandledExceptionFilter InitializeSListHead GetFileInformationByHandleEx SetFileInformationByHandle GetLastError DeleteFileW RegisterWaitForSingleObject CloseHandle FindClose GetCurrentProcessId CreateMutexW GetCurrentDirectoryW IsDebuggerPresent

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

strchr strrchr __C_specific_handler __current_exception __current_exception_context memcpy memchr memset __CxxFrameHandler3 memcmp memmove

api-ms-win-crt-string-l1-1-0

strspn strcmp strlen strncmp strcspn

api-ms-win-crt-math-l1-1-0

__setusermatherr pow _dclass fabs log

api-ms-win-crt-heap-l1-1-0

_set_new_mode free realloc _msize malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _endthreadex _beginthreadex terminate _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _configure_narrow_argv _initialize_narrow_environment __p___argc _get_initial_narrow_environment _initterm _initterm_e exit _exit _initialize_onexit_table _register_onexit_function _crt_atexit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_65cee9be9cce9240e67782ffd37bc2bc_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic