2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer
Size 382KB
Sample260905-e5m7vawhkh
SHA256 30540a6636b565bb3c38116b8792938a0c337db8e092e4509ecb9686426ce0d5
MD5 881091f4b268f6c8546d585db84cb43c
SHA1 06bcf77e9d860a4d33cca257bbebaf843a78030f
SHA512 9f7df189442e549c83898b362ed9d71323a664751d2427fd46de741d59eaa7c2ab9f156953258882b0a8fe76626242ca7e600a998f6ef710f4bf7dbc4ea57699
SSDEEP 6144:Dxr0m5AZuMvk/Bv0eOYALMge74hTqKkVqaaxrPyr8l3:Dxf52zMSly0NkVBaF
TLSH
T14C842912FE565CA8C096C87483168AA32A2174CF0B32F8FF15D905293F6DBF56F28759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer

File Explorer

2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer

.exe 382KB

2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer

IMPHASH 1ed64d35c36a4a033ffa25e1dea771b2
SHA256 30540a6636b565bb3c38116b8792938a0c337db8e092e4509ecb9686426ce0d5
MD5 881091f4b268f6c8546d585db84cb43c
SHA1 06bcf77e9d860a4d33cca257bbebaf843a78030f
SHA512 9f7df189442e549c83898b362ed9d71323a664751d2427fd46de741d59eaa7c2ab9f156953258882b0a8fe76626242ca7e600a998f6ef710f4bf7dbc4ea57699
SSDEEP 6144:Dxr0m5AZuMvk/Bv0eOYALMge74hTqKkVqaaxrPyr8l3:Dxf52zMSly0NkVBaF
TLSH
T14C842912FE565CA8C096C87483168AA32A2174CF0B32F8FF15D905293F6DBF56F28759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

283116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stub_rust.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

FreeSid CheckTokenMembership OpenProcessToken AllocateAndInitializeSid RegQueryValueExW RegCloseKey RegOpenKeyExW SystemFunction036

kernel32

GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter FreeLibrary FindNextFileW GetCommandLineW CreateMutexA GetLastError CloseHandle SetFileAttributesW MoveFileExW SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter SetHandleInformation GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread GetTempPathW DeleteFileW CreateWaitableTimerExW SetWaitableTimer Sleep CopyFileExW SwitchToThread IsProcessorFeaturePresent CreateToolhelp32Snapshot Process32FirstW Process32NextW CheckRemoteDebuggerPresent GetTickCount64 GetVolumeInformationA OpenProcess TerminateProcess GetFinalPathNameByHandleW

ntdll

NtOpenFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile

psapi

GetModuleFileNameExW

shell32

SHGetFolderPathW ShellExecuteW

ws2_32

getaddrinfo recv send WSADuplicateSocketW freeaddrinfo connect setsockopt closesocket WSASocketW WSACleanup WSAGetLastError WSAStartup

vcruntime140

memset memmove __C_specific_handler __current_exception_context __current_exception __CxxFrameHandler3 _CxxThrowException memcpy memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _set_app_type exit _configure_narrow_argv _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit _initterm_e terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_881091f4b268f6c8546d585db84cb43c_akira_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

psapi

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic