2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer
Size 2.3MB
Sample260910-t2dassvvaz
SHA256 5dd45ab244f9621f56f70e79a32257e468c0ccbdab49388606e63dbc740abc09
MD5 5a9c4ba5b947f4d112f93d967b78466a
SHA1 8c6556c152bd9a8b4d65cf1239272d2a7b3c3896
SHA512 5289a4010ac05a8ddb0acc63307093774c263190b494cbba09ecc21169790db326cccea1e3632890d9d38032323f86bff3a0f1fde6ca89478c34a2b481000068
SSDEEP 24576:leXB3PZXoPdNcNCZ8Vrz1b5ZYI/E99H3r6IDjMgDFfIbd4:oXBBXoPANCZOz1boiE9BTD4glI
TLSH
T1D5B5FB93A2DC5CF6C51A84BBAD278913B1367A9BB01EA4670EFFEB341DD7B601706110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer

.exe 2.3MB

2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer

IMPHASH 7a910879812061e115033e06e88457a1
SHA256 5dd45ab244f9621f56f70e79a32257e468c0ccbdab49388606e63dbc740abc09
MD5 5a9c4ba5b947f4d112f93d967b78466a
SHA1 8c6556c152bd9a8b4d65cf1239272d2a7b3c3896
SHA512 5289a4010ac05a8ddb0acc63307093774c263190b494cbba09ecc21169790db326cccea1e3632890d9d38032323f86bff3a0f1fde6ca89478c34a2b481000068
SSDEEP 24576:leXB3PZXoPdNcNCZ8Vrz1b5ZYI/E99H3r6IDjMgDFfIbd4:oXBBXoPANCZOz1boiE9BTD4glI
TLSH
T1D5B5FB93A2DC5CF6C51A84BBAD278913B1367A9BB01EA4670EFFEB341DD7B601706110
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1148004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent.pdb

ole32

CoCreateInstance CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoInitializeEx

kernel32

GetFinalPathNameByHandleW SetFileCompletionNotificationModes GetACP LoadLibraryExA IsValidCodePage GetCommandLineW GetCommandLineA RtlPcToFileHeader Sleep SetEnvironmentVariableW GetStringTypeW GetModuleHandleW GetCurrentProcess WaitForSingleObjectEx ReleaseMutex WaitForSingleObject FindClose SleepEx SetHandleInformation GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW SetWaitableTimer GetProcessTimes GetSystemTimes GetProcessIoCounters LocalFree OpenProcess InitializeCriticalSectionAndSpinCount GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead HeapSize FindNextFileW GetOEMCP VirtualProtect WriteFile EncodePointer SetFilePointerEx GetProcessHeap HeapFree HeapAlloc SwitchToThread GetTimeZoneInformationForYear GetTickCount GetLocalTime GetSystemTimeAsFileTime GlobalMemoryStatusEx GetTickCount64 CreateMutexA FlushFileBuffers GetComputerNameExW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetModuleHandleExW TerminateProcess HeapReAlloc LoadLibraryExW TlsFree TlsSetValue GetQueuedCompletionStatusEx TlsGetValue TlsAlloc CreateIoCompletionPort IsProcessorFeaturePresent InitializeCriticalSectionEx GetCurrentThread GetStartupInfoW SetThreadStackGuarantee SetLastError ReadProcessMemory FreeEnvironmentStringsW GetEnvironmentStringsW SetFileAttributesW GetLastError GetDiskFreeSpaceExA CompareStringOrdinal QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW CloseHandle MultiByteToWideChar GetTempFileNameA RtlVirtualUnwind GetTempPathA WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP lstrlenW WriteConsoleW ReadFileEx WriteFileEx RtlLookupFunctionEntry RtlCaptureContext CreateThread CreateFileW GetCurrentDirectoryW GetSystemTimePreciseAsFileTime CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetLogicalDrives FreeLibrary GetSystemInfo CreateWaitableTimerExW GetCPInfo FormatMessageW GetProcAddress LoadLibraryA GetModuleHandleA VirtualQueryEx CompareStringW DeviceIoControl GetCurrentThreadId PostQueuedCompletionStatus AddVectoredExceptionHandler IsDebuggerPresent Process32Next Process32First CreateToolhelp32Snapshot GetCurrentProcessId LCMapStringW SetStdHandle

user32

GetForegroundWindow GetCursorPos MessageBoxA SendMessageTimeoutA FindWindowA ShowWindow SystemParametersInfoW EnumDisplayMonitors GetWindowDC EnumDisplaySettingsW GetMonitorInfoW ReleaseDC BlockInput SwapMouseButton SendInput GetLastInputInfo GetDesktopWindow

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

advapi32

RegGetValueW RegCloseKey RegQueryValueExW LookupAccountSidW GetTokenInformation OpenProcessToken CopySid GetLengthSid IsValidSid SystemFunction036 RegOpenKeyExW

gdi32

CreateCompatibleBitmap SelectObject BitBlt GetDIBits CreateCompatibleDC DeleteObject DeleteDC

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile NtQuerySystemInformation NtReadFile NtCreateFile RtlNtStatusToDosError NtWriteFile RtlGetVersion NtOpenFile NtDeviceIoControlFile NtQueryInformationProcess

mfplat

MFShutdown MFCreateSample MFStartup MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

psapi

GetPerformanceInfo GetModuleFileNameExW

oleaut32

GetErrorInfo SysAllocString SysFreeString SysStringLen VariantClear

ws2_32

WSASend closesocket freeaddrinfo getsockname getpeername WSAIoctl recv send getsockopt select getaddrinfo shutdown WSACleanup WSAStartup connect WSAGetLastError ioctlsocket setsockopt WSASocketW bind

secur32

DeleteSecurityContext FreeCredentialsHandle ApplyControlToken EncryptMessage DecryptMessage InitializeSecurityContextW LsaFreeReturnBuffer LsaGetLogonSessionData LsaEnumerateLogonSessions AcceptSecurityContext FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleA

bcrypt

BCryptGenRandom

crypt32

CertDuplicateStore CertFreeCertificateContext CertGetCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateContext CertCloseStore CertFreeCertificateChain CertOpenStore

bcryptprimitives

ProcessPrng

iphlpapi

GetIfTable2 GetAdaptersAddresses FreeMibTable

netapi32

NetUserGetInfo NetApiBufferFree NetUserGetLocalGroups NetUserEnum

shell32

CommandLineToArgvW

pdh

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryA

powrprof

CallNtPowerInformation

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

597KB

Virtual Size

597KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer

ole32

kernel32

user32

api-ms-win-core-synch-l1-2-0

advapi32

gdi32

ntdll

mfplat

mfreadwrite

mf

psapi

oleaut32

ws2_32

secur32

bcrypt

crypt32

bcryptprimitives

iphlpapi

netapi32

shell32

pdh

powrprof

generic