91733a3a6debcb075f0434810022eade27e8ad9324a024ad703f63bf07f988e9

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ce8cef7cbfcef344085f98d24b69ae5f_akira_glassworm_rusty-stealer.exe
Size 1.3MB
Sample260826-kkdessvgpf
SHA256 91733a3a6debcb075f0434810022eade27e8ad9324a024ad703f63bf07f988e9
MD5 ce8cef7cbfcef344085f98d24b69ae5f
SHA1 24c5314e38852ed4b62cbd429a00aaa5c639c617
SHA512 4ec79ca39f17fefb690db13158b902c9d80853efa2a937904e0004b7cba1d47c49e67e1e6f31a4f4884471f36854dd3649e7b1a8930cea04927583a0521914a7
SSDEEP 24576:HA9BjOctSa5AOR7KiZb3Iwty1zhg7abk13t7NU:HA7OctAW3dy1dsckpt
TLSH
T148555B43F66584EEC51AC078C61A9233BA32789E0735B6FB67D44A343E66FD02A3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2396	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2396	4496	2026-08-25_ce8cef7cbfcef344085f98d24b69ae5f_akira_glassworm_rusty-stealer.exe	92
PID 2396 wrote to memory of 1340	2396	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ce8cef7cbfcef344085f98d24b69ae5f_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ce8cef7cbfcef344085f98d24b69ae5f_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /C tar -xf C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.zip -C C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\tar.exe
    tar -xf C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.zip -C C:\Users\Admin\AppData\Local\Temp\
    3⤵
    PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsUpdate.zip

Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.zip
Size 2.2MB
SHA256 4cf4198354abfee7e502c85f38e62dbb90fec976e4df38d0ecbfd811937c1981
MD5 f2146c45b21c27921e3fefe93135e814
SHA1 32780fc488783486357d8363ecbf49c9ae714501
SHA512 1d4f4f8fa9518e496de2d506b352ffa0ac4475643f80536b20e4e52b07fcbc0ea7990356d32e002e65a987b35109ae3638015e9fb351df19038ff22dfa1f59d7
SSDEEP 49152:07+8TVPSSd6GNu3hZlsvbcxKrd4/g+EQnqfnYoqb:0vt1QvsigH+EQq/Yo4
TLSH
T141B533C2C44E8141DA66E2B8DA5CA8D541296DEB9BDC8770C887D9392B4741331EFFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download