2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer
Size 2.7MB
Sample260825-ehy1tsfh23
SHA256 1ad192561f0b676735b4dbb91412b577536b9459e7caf5ee882517b530ccd857
MD5 b0e91fbca42fa950838db3295e9c7fd7
SHA1 883e3d3f96934e70aa54626b9468b5a633c7eeea
SHA512 7844043fc799af68a2ab0bc1e6b9e72a5682c1f2ee6f94d55c61aa9857e47e5f9c9c150cd0a0b0262fb827000dedccccca41f6adfbb032046b422a1edee27def
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3p:CebAjOKn3wRKRJ3p
TLSH
T164D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer

File Explorer

2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer

.exe 2.7MB

2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer

IMPHASH 14b4507f976e32ec2f82aea1cd56dda1
SHA256 1ad192561f0b676735b4dbb91412b577536b9459e7caf5ee882517b530ccd857
MD5 b0e91fbca42fa950838db3295e9c7fd7
SHA1 883e3d3f96934e70aa54626b9468b5a633c7eeea
SHA512 7844043fc799af68a2ab0bc1e6b9e72a5682c1f2ee6f94d55c61aa9857e47e5f9c9c150cd0a0b0262fb827000dedccccca41f6adfbb032046b422a1edee27def
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3p:CebAjOKn3wRKRJ3p
TLSH
T164D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2130360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

client.pdb

kernel32

GetVolumeInformationW GetDiskFreeSpaceExW DeviceIoControl OpenProcess GetExitCodeProcess WaitForMultipleObjects GetProcessTimes GetSystemTimes GetProcessIoCounters GetFileAttributesW CreateProcessW GetWindowsDirectoryW VirtualQueryEx GetTickCount64 GetLogicalDrives GlobalMemoryStatusEx GetSystemDirectoryW ReadFile GetOverlappedResult CancelIo PostQueuedCompletionStatus CreateEventW ExitProcess CreateWaitableTimerExW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI GetSystemInfo GetSystemTimePreciseAsFileTime ReadFileEx SleepEx WriteFileEx CreateThread DeleteFileW GetTempPathW GetModuleFileNameW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetModuleHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SwitchToThread GlobalUnlock GlobalLock HeapReAlloc GetCurrentThread SetThreadStackGuarantee LoadLibraryA WaitForSingleObject SetFileInformationByHandle MoveFileExW GlobalSize GlobalAlloc GetComputerNameExW WaitForMultipleObjectsEx SetThreadPriority GetCurrentThreadId SetEvent CreateEventA CopyFileExW FindClose FindNextFileW GetModuleHandleA Sleep FormatMessageW HeapAlloc HeapFree GetProcessHeap LoadLibraryExA GetProcAddress FreeLibrary DuplicateHandle SetHandleInformation TerminateProcess IsProcessorFeaturePresent SetLastError LocalFree GetDriveTypeW GlobalFree CloseHandle SetWaitableTimer GetLastError SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter IsDebuggerPresent lstrlenW MultiByteToWideChar WideCharToMultiByte AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal ReadProcessMemory FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

combase

CoTaskMemFree

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile RtlGetVersion NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

mfplat

MFCreateSample MFStartup MFShutdown MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

oleaut32

SysAllocString GetErrorInfo SysFreeString VariantClear SysStringLen

ws2_32

socket getaddrinfo freeaddrinfo recv send ioctlsocket closesocket connect bind setsockopt getpeername WSAGetLastError getsockname WSACleanup getsockopt WSAIoctl WSASocketW WSASend shutdown WSAStartup

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

secur32

LsaGetLogonSessionData DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA LsaFreeReturnBuffer LsaEnumerateLogonSessions EncryptMessage FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle DecryptMessage ApplyControlToken InitializeSecurityContextW

crypt32

CertDuplicateCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertFreeCertificateContext CertEnumCertificatesInStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertCloseStore CertOpenStore

advapi32

RevertToSelf GetLengthSid IsValidSid ImpersonateAnonymousToken SystemFunction036 GetTokenInformation OpenProcessToken GetUserNameW LookupAccountSidW CopySid RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

user32

ShowWindow FindWindowA EmptyClipboard EnumDisplaySettingsExW GetMonitorInfoW EnumDisplayMonitors CloseClipboard OpenClipboard SetClipboardData MessageBoxA GetClipboardData BlockInput

shlwapi

AssocQueryStringW

gdi32

GetObjectW GetDIBits StretchBlt SetStretchBltMode SelectObject CreateCompatibleBitmap CreateDCW GetDeviceCaps DeleteDC CreateCompatibleDC DeleteObject

iphlpapi

GetIfTable2 GetIfEntry2 FreeMibTable GetAdaptersAddresses GetIpForwardTable

powrprof

SetSuspendState CallNtPowerInformation

shell32

SHGetKnownFolderPath CommandLineToArgvW

psapi

GetModuleFileNameExW GetPerformanceInfo

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter PdhCloseQuery

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserGetInfo NetUserEnum

vcruntime140

__current_exception memcpy __CxxFrameHandler3 strrchr __C_specific_handler memmove memcmp strchr memchr memset __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr log _dclass fabs pow roundf

api-ms-win-crt-string-l1-1-0

strncmp strcspn strspn strlen wcslen strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment terminate _initterm_e _configure_narrow_argv exit _exit __p___argc _crt_atexit _set_app_type _seh_filter_exe _endthreadex _register_onexit_function _initialize_onexit_table _beginthreadex __p___argv strerror _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

free realloc malloc _msize _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_b0e91fbca42fa950838db3295e9c7fd7_akira_glassworm_rusty-stealer

kernel32

combase

ntdll

ole32

mfplat

mfreadwrite

mf

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

secur32

crypt32

advapi32

bcrypt

bcryptprimitives

user32

shlwapi

gdi32

iphlpapi

powrprof

shell32

psapi

pdh

netapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic