2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer
Size 4.8MB
Sample260820-pcvrbsbp6x
SHA256 c5931861e50370e51347129a30c8ae9170cad456a3ab088b1f5821d69bbc9568
MD5 95ca219c4284ddfd97d4474df661df79
SHA1 20c8efab577deec246dd949687054feda529fa21
SHA512 b4305357b4fbdadcbbb925f07cad44535f096a1e81d25bcba6f14f3b6df133737f18a0278cacdbcf24699ec413f9f9a0e5d34e81299ac0c7b7ffe0fb5e8e87b9
SSDEEP 49152:4CrpnoO7I8h5onj/m5u+EEWEHAqndoO96BnHPzutEKPtf41oXh0Tqsb8YFIOnqJx:9JZ5AzNI8Aaam+cgAaMd7uaa5SZLjY
TLSH
T13B363A217A9A99ADC05AC07483478A736A7130DB0B39BAFF448456783F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer

File Explorer

2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer

.exe 4.8MB

2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer

IMPHASH a6c4d4373d7ba79ac0050e4e4ad87cc7
SHA256 c5931861e50370e51347129a30c8ae9170cad456a3ab088b1f5821d69bbc9568
MD5 95ca219c4284ddfd97d4474df661df79
SHA1 20c8efab577deec246dd949687054feda529fa21
SHA512 b4305357b4fbdadcbbb925f07cad44535f096a1e81d25bcba6f14f3b6df133737f18a0278cacdbcf24699ec413f9f9a0e5d34e81299ac0c7b7ffe0fb5e8e87b9
SSDEEP 49152:4CrpnoO7I8h5onj/m5u+EEWEHAqndoO96BnHPzutEKPtf41oXh0Tqsb8YFIOnqJx:9JZ5AzNI8Aaam+cgAaMd7uaa5SZLjY
TLSH
T13B363A217A9A99ADC05AC07483478A736A7130DB0B39BAFF448456783F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2868204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stremio_shell_ng.pdb

user32

GetForegroundWindow GetSystemMetrics SetWindowPlacement GetClientRect MonitorFromWindow GetMonitorInfoW GetDisplayConfigBufferSizes IsZoomed DisplayConfigGetDeviceInfo GetKeyState GetWindowRect GetMonitorInfoA SetWindowLongA EnumChildWindows GetWindowPlacement IsIconic SetWindowPos GetWindowLongA SetForegroundWindow QueryDisplayConfig AdjustWindowRectEx SendNotifyMessageW SetProcessDPIAware MessageBoxW GetParent CreateIconIndirect GetCursorPos CreateWindowExW DefWindowProcW SetParent AppendMenuW CreatePopupMenu SetMenuInfo GetMenu DrawMenuBar CheckMenuItem IsWindowVisible SendMessageW ShowWindow IsWindow TrackPopupMenu SetMenuItemInfoW GetSubMenu DeleteMenu GetMenuItemID GetMenuItemCount DestroyWindow DestroyMenu DispatchMessageW TranslateMessage IsDialogMessageW GetAncestor GetMessageW PostMessageW CreateMenu LoadImageW GetDC DestroyIcon SetMenu ReleaseDC LoadCursorW RegisterClassExW GetClassNameW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile

kernel32

GetQueuedCompletionStatusEx AssignProcessToJobObject PostQueuedCompletionStatus SetFileCompletionNotificationModes GetTempPathW CreateIoCompletionPort SetHandleInformation WriteFile GetTempFileNameW CreateActCtxW WaitNamedPipeW GetSystemInfo SetUnhandledExceptionFilter UnhandledExceptionFilter ActivateActCtx InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetModuleHandleA GetFileType GetFileAttributesW Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW AcquireSRWLockExclusive LockResource SizeofResource FindResourceW LoadResource GetModuleFileNameW HeapAlloc SetEnvironmentVariableW DeleteFileW CreateFileW ReleaseSRWLockExclusive GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx LoadLibraryW WideCharToMultiByte SwitchToThread ExitProcess GetModuleHandleW CloseHandle CreateNamedPipeW ConnectNamedPipe FindClose FindFirstFileExW GetLastError ReadFile FlushFileBuffers lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW FormatMessageW GetStdHandle GetEnvironmentStringsW DisconnectNamedPipe TerminateProcess CreateJobObjectA SetInformationJobObject MultiByteToWideChar GetProcessId GetCurrentProcess GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo GetExitCodeProcess IsDebuggerPresent GetProcAddress FreeLibrary CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW CreateProcessW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetWindowsDirectoryW GetCurrentProcessId ReadFileEx DuplicateHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW IsProcessorFeaturePresent OutputDebugStringW

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDevice

ws2_32

ioctlsocket WSASend getsockname getpeername WSASocketW connect shutdown setsockopt WSAIoctl closesocket WSAGetLastError getaddrinfo getsockopt recv bind send WSAStartup freeaddrinfo WSACleanup

secur32

AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DecryptMessage AcquireCredentialsHandleA ApplyControlToken EncryptMessage QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle

crypt32

CertAddCertificateContextToStore CertDuplicateCertificateChain CertCloseStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateContext CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertOpenStore

advapi32

GetUserNameW SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

gdi32

CreateSolidBrush CreateDIBSection DeleteObject GetDeviceCaps

comctl32

InitCommonControlsEx RemoveWindowSubclass DefSubclassProc GetWindowSubclass SetWindowSubclass

shell32

Shell_NotifyIconW DragQueryFileW DragQueryPoint DragFinish GetCurrentProcessExplicitAppUserModelID

windowscodecs

WICConvertBitmapSource

libmpv-2

mpv_command mpv_create_client mpv_observe_property mpv_request_event mpv_destroy mpv_terminate_destroy mpv_initialize mpv_create mpv_client_api_version mpv_free mpv_get_property mpv_set_property mpv_wait_event

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception_context __current_exception __CxxFrameHandler3 memcpy memset memmove memcmp _CxxThrowException wcsrchr _purecall __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

exit terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _crt_atexit __p___argv _exit _register_onexit_function __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_95ca219c4284ddfd97d4474df661df79_akira_glassworm_rusty-stealer

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

dwmapi

d3d11

ws2_32

secur32

crypt32

advapi32

ole32

shlwapi

bcrypt

gdi32

comctl32

shell32

windowscodecs

libmpv-2

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic