2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer
Size 1.7MB
Sample260910-pdhs6awwfx
SHA256 7ee3a7416673e2f288042ed81fddbecb74d5f16a5c30688879e18e994530ed6c
MD5 ad0ec3d2e6f86633096297ea8d144dfd
SHA1 754cfa09531fc6cab1b9c297883dda81c0ae43e2
SHA512 13c5d483e06c2868ede6879ee9a00cbe1fab44943b1452086dddfefee1e217393b841b66ccec79765f876df57730be12c12ef8015e67f6e8ebb463c965635c3a
SSDEEP 24576:QWSJT4Wz1z05Kl+0ywuxtBPbBYVUWNxbCXox0CEFfOPAy:0JTr100nyJtB9IUWN1Jxniw
TLSH
T1BD856B03E69584FAC49DC078C3579136BA32B88E4B25B6EF2BD45A213E27F906F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer

File Explorer

2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer

.exe 1.7MB

2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer

IMPHASH 39a682b93b7556c37fbda92d018ffc2c
SHA256 7ee3a7416673e2f288042ed81fddbecb74d5f16a5c30688879e18e994530ed6c
MD5 ad0ec3d2e6f86633096297ea8d144dfd
SHA1 754cfa09531fc6cab1b9c297883dda81c0ae43e2
SHA512 13c5d483e06c2868ede6879ee9a00cbe1fab44943b1452086dddfefee1e217393b841b66ccec79765f876df57730be12c12ef8015e67f6e8ebb463c965635c3a
SSDEEP 24576:QWSJT4Wz1z05Kl+0ywuxtBPbBYVUWNxbCXox0CEFfOPAy:0JTr100nyJtB9IUWN1Jxniw
TLSH
T1BD856B03E69584FAC49DC078C3579136BA32B88E4B25B6EF2BD45A213E27F906F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0c:c0:cb:d2:2b:a5:81:57:d0:80:1b:73:e4:79:25:30:01:c1:97:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Contoso Ltd.

Chains

Aug 31, 2026

CN=Contoso Ltd.

Subject

CN=Contoso Ltd.

Serial Number

32:9c:6f:39:50:6d:af:94:4f:1d:76:b1:f0:ae:6e:f2

Issuer

CN=Contoso Ltd.

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 31, 2026 - Aug 31, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

1143188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent.pdb

kernel32

GetVolumeInformationW GetDriveTypeW OpenProcess GetProcessHeap LocalFree HeapAlloc FormatMessageW GetTimeZoneInformationForYear GetProcessIoCounters HeapReAlloc GetComputerNameExW GetSystemTimes GetProcessTimes SetWaitableTimer GetTempPathW GetExitCodeProcess GetTickCount64 WaitForMultipleObjects DuplicateHandle GetModuleFileNameW GetFileAttributesW ExitProcess GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetFileInformationByHandle FindFirstFileExW CreateIoCompletionPort SetFileTime GetFullPathNameW SetHandleInformation SleepEx WaitForSingleObject ReleaseMutex GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx GetCurrentProcess GetCurrentThreadId GetModuleHandleW Sleep LoadLibraryExA SetFileCompletionNotificationModes GetFinalPathNameByHandleW SetLastError IsProcessorFeaturePresent GetDiskFreeSpaceExW GetLogicalDrives ReadProcessMemory GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsW CreateMutexA GetStdHandle GetConsoleMode GetConsoleOutputCP GetEnvironmentStringsW WriteConsoleW ReadFileEx WriteFileEx CompareStringOrdinal QueryPerformanceCounter CreateThread CreateFileW QueryPerformanceFrequency GetSystemTimePreciseAsFileTime CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentVariableW UnhandledExceptionFilter GetSystemInfo CreateWaitableTimerExW MultiByteToWideChar RtlVirtualUnwind SwitchToThread FindClose FindNextFileW VirtualQueryEx SetFileInformationByHandle GetLastError DeviceIoControl GlobalMemoryStatusEx DeleteFileW PostQueuedCompletionStatus WideCharToMultiByte lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW GetProcAddress GetModuleHandleA GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler HeapFree CloseHandle

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey LookupAccountSidW IsValidSid GetTokenInformation OpenProcessToken CopySid SystemFunction036 GetLengthSid RegGetValueW

user32

EnumDisplayMonitors GetWindowDC ReleaseDC GetDesktopWindow EnumDisplaySettingsW GetMonitorInfoW

gdi32

CreateCompatibleDC BitBlt GetDIBits DeleteDC CreateCompatibleBitmap DeleteObject SelectObject

ntdll

NtOpenFile NtWriteFile NtQuerySystemInformation RtlNtStatusToDosError NtReadFile NtQueryInformationProcess NtDeviceIoControlFile RtlGetVersion NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile

mfplat

MFCreateAttributes MFCreateSample MFStartup MFShutdown

ole32

CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance CoSetProxyBlanket

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

psapi

GetModuleFileNameExW GetPerformanceInfo

oleaut32

SysStringLen VariantClear SysFreeString SysAllocString GetErrorInfo

ws2_32

WSAIoctl WSASend getsockopt setsockopt WSASocketW getsockname bind WSAStartup WSACleanup getaddrinfo freeaddrinfo getpeername shutdown recv send select connect ioctlsocket WSAGetLastError closesocket

secur32

QueryContextAttributesW AcquireCredentialsHandleA LsaFreeReturnBuffer LsaGetLogonSessionData LsaEnumerateLogonSessions EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle DeleteSecurityContext

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain CertOpenStore CertDuplicateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore

bcryptprimitives

ProcessPrng

iphlpapi

GetIfTable2 FreeMibTable GetAdaptersAddresses

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserEnum NetUserGetInfo

shell32

CommandLineToArgvW

pdh

PdhCollectQueryData PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA

powrprof

CallNtPowerInformation

vcruntime140

__current_exception __current_exception_context __C_specific_handler memset memmove memcmp __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

__setusermatherr floorf roundf log2 pow ceilf

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc free

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm terminate _get_initial_narrow_environment _initterm_e _cexit __p___argv _c_exit __p___argc _initialize_narrow_environment _configure_narrow_argv exit _exit _set_app_type _crt_atexit _seh_filter_exe _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_ad0ec3d2e6f86633096297ea8d144dfd_akira_glassworm_rusty-stealer

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

user32

gdi32

ntdll

mfplat

ole32

mfreadwrite

mf

psapi

oleaut32

ws2_32

secur32

bcrypt

crypt32

bcryptprimitives

iphlpapi

netapi32

shell32

pdh

powrprof

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic