2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer
Size 1.3MB
Sample260905-bfhpaa1tfx
SHA256 b192636f77a2995ee8ad28182a3a6d8d945e23c9bc8d7fc306260e8b46b1e221
MD5 a7af3e240be8c50c680d8706a3b3d640
SHA1 a966e75e7889b2f1cd6e6916bc3cef301b808e42
SHA512 8d51d42f5d584060bd0f1968d4c56236771a72737a7fdd0a0ae63ae1e4577f17b9b194ff7d7dd3a366e66306d2f5fc3231c1372eeb4f7b57fe8cbcc2b65fd75a
SSDEEP 24576:ui3z9puZYJCzrnh40xWeBm5arUt/5uFMXVIH06iyguG:ui3xSYJCfnh7xWekarUth44IU6i8
TLSH
T1A9555A53F6A280F8C06DC4B5D34A6672FB31B889472579EB1BE086213E56FD06B3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer

File Explorer

2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer

.exe 1.3MB

2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer

IMPHASH a125bfdd0da2489ff1d56182d4bfda02
SHA256 b192636f77a2995ee8ad28182a3a6d8d945e23c9bc8d7fc306260e8b46b1e221
MD5 a7af3e240be8c50c680d8706a3b3d640
SHA1 a966e75e7889b2f1cd6e6916bc3cef301b808e42
SHA512 8d51d42f5d584060bd0f1968d4c56236771a72737a7fdd0a0ae63ae1e4577f17b9b194ff7d7dd3a366e66306d2f5fc3231c1372eeb4f7b57fe8cbcc2b65fd75a
SSDEEP 24576:ui3z9puZYJCzrnh40xWeBm5arUt/5uFMXVIH06iyguG:ui3xSYJCfnh7xWekarUth44IU6i8
TLSH
T1A9555A53F6A280F8C06DC4B5D34A6672FB31B889472579EB1BE086213E56FD06B3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1013456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW GetEnvironmentVariableW GetCommandLineW GetProcessHeap HeapFree AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetModuleHandleA LoadLibraryA GetProcAddress GetFileInformationByHandleEx GetLastError CloseHandle SetFileInformationByHandle SwitchToThread FindNextFileW FindClose FindFirstFileExW SetFilePointerEx WaitForSingleObject SetHandleInformation QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer QueryPerformanceFrequency Sleep GetSystemTimePreciseAsFileTime IsDebuggerPresent SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc FormatMessageW CreateThread GetFullPathNameW CreateFileW SetFileTime GetFileInformationByHandle FlushFileBuffers CreateDirectoryW ExitProcess GetModuleFileNameW GetTempPathW DeleteFileW GetFinalPathNameByHandleW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetConsoleWindow IsProcessorFeaturePresent TerminateProcess GetCurrentThreadId

user32

GetWindowTextW GetSystemMetrics GetDesktopWindow GetForegroundWindow ShowWindow

gdi32

DeleteDC GetObjectW SelectObject CreateCompatibleDC

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtReadFile

ws2_32

getaddrinfo ioctlsocket connect select getsockopt WSASend WSAStartup WSACleanup WSASocketW closesocket setsockopt WSAGetLastError recv freeaddrinfo

bcrypt

BCryptGenRandom

vcruntime140

memmove __C_specific_handler memcpy __CxxFrameHandler3 memcmp memset __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _configure_narrow_argv _initterm_e exit _exit _set_app_type _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _seh_filter_exe terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_a7af3e240be8c50c680d8706a3b3d640_akira_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

gdi32

advapi32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic