2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer
Size 5.1MB
Sample260901-1mc5tabp3s
SHA256 85e99f7bdc5b5d6c8ab35f160c19710102083cee2d3b884b45bab477033d93a2
MD5 0d72584a874a797a8c21f5895b747108
SHA1 cf7eb5d59480a135f653239b4128deff57837dae
SHA512 96d2112f129c2a761043d5d72c6f7ef71abf94ace5db1210894e96ecaba8d74c794bfac090ebaa3d59337e3ca20cdfcc5ff835d252ffa38fabebc3801fd3d0d2
SSDEEP 49152:FEdmGzM8OZkIGTg9qb0HtEcdFGEe1Q5DYFNnFL8sbsrqVO2w7GiOiBEHfEc1EM37:LTGf2XeKFm0B/OaCdZTCnq+v7zpd+G4
TLSH
T15436F817F6B660D8C0BBC0789283AB22BD71749947386BE746C1826A1F21FF4AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer

File Explorer

2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer

.exe 5.1MB

2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer

IMPHASH cac4593ddc74238c233c2f93f3ae88be
SHA256 85e99f7bdc5b5d6c8ab35f160c19710102083cee2d3b884b45bab477033d93a2
MD5 0d72584a874a797a8c21f5895b747108
SHA1 cf7eb5d59480a135f653239b4128deff57837dae
SHA512 96d2112f129c2a761043d5d72c6f7ef71abf94ace5db1210894e96ecaba8d74c794bfac090ebaa3d59337e3ca20cdfcc5ff835d252ffa38fabebc3801fd3d0d2
SSDEEP 49152:FEdmGzM8OZkIGTg9qb0HtEcdFGEe1Q5DYFNnFL8sbsrqVO2w7GiOiBEHfEc1EM37:LTGf2XeKFm0B/OaCdZTCnq+v7zpd+G4
TLSH
T15436F817F6B660D8C0BBC0789283AB22BD71749947386BE746C1826A1F21FF4AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4010540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

scadaver-800e5c6eb960fe94.pdb

kernel32

UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI GetCurrentThreadId LockFileEx GetFileSize CreateFileW GetConsoleMode QueryPerformanceCounter FormatMessageA WideCharToMultiByte SystemTimeToFileTime OutputDebugStringW FormatMessageW MultiByteToWideChar OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection RtlVirtualUnwind GetCurrentProcessId GetProcessHeap CloseHandle FreeEnvironmentStringsW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer RtlCaptureContext RtlLookupFunctionEntry FreeLibrary GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle GetCurrentProcess DuplicateHandle SetFilePointerEx WriteConsoleW WriteFileEx SleepEx GetExitCodeProcess TerminateProcess QueryPerformanceFrequency GetSystemTimePreciseAsFileTime FindFirstFileExW FindClose lstrlenW ReleaseMutex CreateEventW CancelIo GetModuleHandleW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx CreateThread GetFileInformationByHandle GetFileType GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetConsoleOutputCP CreateMutexA GetSystemTimeAsFileTime LocalFree WaitForMultipleObjects WriteFile GetOverlappedResult ReadFile SetHandleInformation GetSystemTime CreateFileMappingW MapViewOfFile IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetTickCount FlushFileBuffers InitializeSListHead GetProcAddress GetModuleHandleA SetLastError Sleep GetLastError GetFileInformationByHandleEx IsDebuggerPresent

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSAGetLastError select WSAStartup WSACleanup freeaddrinfo ioctlsocket setsockopt getaddrinfo sendto send recvfrom recv shutdown getsockname connect bind WSASocketW closesocket getsockopt

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

strrchr memcpy __CxxFrameHandler3 memset memmove memcmp memchr strchr __current_exception __C_specific_handler _CxxThrowException __current_exception_context

api-ms-win-crt-string-l1-1-0

strncmp strlen strspn strcspn strcmp

api-ms-win-crt-math-l1-1-0

_dclass fmod log fabs floor __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _msize realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _get_initial_narrow_environment _initialize_narrow_environment __p___argv _initterm_e exit _beginthreadex _endthreadex _configure_narrow_argv _seh_filter_exe _set_app_type __p___argc _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_0d72584a874a797a8c21f5895b747108_akira_rusty-stealer

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic