2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer
Size 24.2MB
Sample260820-lynclathjf
SHA256 bd7576dcc11c3b1cd5f7de9b1df2691e5314d3fc9d3c49a8737923dee66aea9c
MD5 7d1fa66c50be1a132a42042198f96a53
SHA1 8b426a8d4470db7800f5e47a87b8ded015011f89
SHA512 ea36adf3da0ded77a323143d55e78fd566a73c37114d7f69914c8912512317640db61e41a9f770b024e5da88e0c7c1b7bc9d49a6f5124e513b4a7fa0a9f90d89
SSDEEP 98304:cgefhCe2EcHe5Iqxb1HEUDfDLrM6rF3XjV7ujFJeH0liM53l2yYL:cgefhhLIqxb1jM6jSjTxiM53
TLSH
T10A47C61BB77A51D5D1BAC03892539A37F97038A9433867E39A808A172F65FF4AD3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer

File Explorer

2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer

.exe 24.2MB

2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer

IMPHASH 50a138c7ff06f790edf7565dee457e36
SHA256 bd7576dcc11c3b1cd5f7de9b1df2691e5314d3fc9d3c49a8737923dee66aea9c
MD5 7d1fa66c50be1a132a42042198f96a53
SHA1 8b426a8d4470db7800f5e47a87b8ded015011f89
SHA512 ea36adf3da0ded77a323143d55e78fd566a73c37114d7f69914c8912512317640db61e41a9f770b024e5da88e0c7c1b7bc9d49a6f5124e513b4a7fa0a9f90d89
SSDEEP 98304:cgefhCe2EcHe5Iqxb1HEUDfDLrM6rF3XjV7ujFJeH0liM53l2yYL:cgefhhLIqxb1jM6jSjTxiM53
TLSH
T10A47C61BB77A51D5D1BAC03892539A37F97038A9433867E39A808A172F65FF4AD3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18887128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rio-345e2826e6ae2e41.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetSystemInfo AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateFileW LocalFree GetConsoleMode GetLastError GetCurrentProcess DuplicateHandle GetWindowsDirectoryW GetFileInformationByHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileInformationByHandleEx SetFileInformationByHandle RegisterWaitForSingleObject GetLocaleInfoEx GetProcessId GetExitCodeProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateProcessW CreatePseudoConsole ResizePseudoConsole Sleep CancelSynchronousIo UnregisterWait HeapAlloc HeapFree GetProcessHeap CreateEventW CreateIoCompletionPort InitializeSListHead PostQueuedCompletionStatus AddVectoredExceptionHandler WaitForSingleObject GetModuleHandleA GetQueuedCompletionStatusEx UnmapViewOfFile ReadFile VirtualQuery GetOverlappedResult WriteFile MapViewOfFile OpenFileMappingW IsDebuggerPresent WaitForSingleObjectEx CancelIo QueryPerformanceCounter CreatePipe GetCurrentThreadId SetWaitableTimer FormatMessageW QueryPerformanceFrequency LoadLibraryA LoadLibraryW GetModuleFileNameW GetProcAddress CreateWaitableTimerExW AreFileApisANSI GetCurrentThread MultiByteToWideChar WideCharToMultiByte lstrlenW ClosePseudoConsole FormatMessageA FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileTime HeapReAlloc CreateThread GetCurrentProcessId ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetEnvironmentStringsW GetSystemDirectoryW TerminateProcess CreateDirectoryW SetFilePointerEx SetThreadStackGuarantee GetCurrentDirectoryW GetTempPathW WaitForMultipleObjects GetModuleHandleW GetFileType GetFileAttributesW GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableW DeleteFileW CompareStringOrdinal ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile

userenv

GetUserProfileDirectoryW

msvcp140

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?fail@ios_base@std@@QEBA_NXZ ?setf@ios_base@std@@QEAAHHH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?classic@locale@std@@SAAEBV12@XZ ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z

vcruntime140

__C_specific_handler strchr strstr __current_exception_context memchr _CxxThrowException __std_exception_copy _purecall memcmp memset memmove __CxxFrameHandler3 memcpy __std_exception_destroy __current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

cos __setusermatherr ceil round floor frexp _dtest fabs acos floorf asin atan atan2 exp log pow sin sqrt powf fmod tan exp2 log2 roundf ceilf _fdtest

api-ms-win-crt-string-l1-1-0

tolower strncmp isdigit strlen strcat_s isalpha toupper strcat strcmp

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc _set_new_mode realloc malloc

api-ms-win-crt-stdio-l1-1-0

fclose fgetc fgetpos fputc fread fsetpos __stdio_common_vsprintf_s _set_fmode _fseeki64 fwrite setvbuf ungetc _get_stream_buffer_pointers __stdio_common_vsprintf __acrt_iob_func __p__commode __stdio_common_vsnprintf_s __stdio_common_vfprintf fflush

api-ms-win-crt-runtime-l1-1-0

terminate _exit _crt_atexit _register_onexit_function _initialize_onexit_table _invoke_watson _wassert _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _set_app_type

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

atoi _itoa_s strtoul

api-ms-win-crt-utility-l1-1-0

abs

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxASIS OnigSyntaxEmacs OnigSyntaxGnuRegex OnigSyntaxGrep OnigSyntaxJava OnigSyntaxOniguruma OnigSyntaxPerl OnigSyntaxPerl_NG OnigSyntaxPosixBasic OnigSyntaxPosixExtended OnigSyntaxPython OnigSyntaxRuby onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_copy_syntax onig_copyright onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_syntax_behavior onig_get_syntax_op onig_get_syntax_op2 onig_get_syntax_options onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_default_syntax onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_meta_char onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_syntax_behavior onig_set_syntax_op onig_set_syntax_op2 onig_set_syntax_options onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onig_version onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_7d1fa66c50be1a132a42042198f96a53_akira_glassworm_rusty-stealer

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

shell32

combase

ntdll

userenv

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic