2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer
Size 1.2MB
Sample260910-xy78jsxtf1
SHA256 322272ccf890f0421b036edfd885bff28ea24d8dbaff93c4c83e77c02be9f859
MD5 1e2d1d2059c964224861c0c8feb3b928
SHA1 10dc6ea09644d9908cd293293372fc3397e7ebb3
SHA512 fc5a7fb2e6a1b55b5f9ec30c1ff094f3ea3d4962619195b57f08f1c06351290945939c47c53349cc37c1aa3f5392879a6c89f209cf1e1de61b7f3e35350b6d6d
SSDEEP 24576:NdnJWUiD4HKGFmOSbkImBIRYtgZT6vyVUDW2cVKZ5Mwsta8+Nx8mWsW75QWJC4fS:NdnJWUgHG0OSQImmRSgZT6vyVUDW2c4D
TLSH
T183456D03E6A581E8D05EC07893179673BE72BC8E8635B6AF1BD41B212F69FA05F1D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer

File Explorer

2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer

.exe 1.2MB

2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer

IMPHASH ad1b04ac85d5cf86fdd22027964d95f7
SHA256 322272ccf890f0421b036edfd885bff28ea24d8dbaff93c4c83e77c02be9f859
MD5 1e2d1d2059c964224861c0c8feb3b928
SHA1 10dc6ea09644d9908cd293293372fc3397e7ebb3
SHA512 fc5a7fb2e6a1b55b5f9ec30c1ff094f3ea3d4962619195b57f08f1c06351290945939c47c53349cc37c1aa3f5392879a6c89f209cf1e1de61b7f3e35350b6d6d
SSDEEP 24576:NdnJWUiD4HKGFmOSbkImBIRYtgZT6vyVUDW2cVKZ5Mwsta8+Nx8mWsW75QWJC4fS:NdnJWUgHG0OSQImmRSgZT6vyVUDW2c4D
TLSH
T183456D03E6A581E8D05EC07893179673BE72BC8E8635B6AF1BD41B212F69FA05F1D704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

921340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

antigravity_bypass_russia.pdb

advapi32

RegOpenKeyExW RegDeleteValueW RegCloseKey RegSetValueExW RegEnumKeyExW RegQueryValueExW RegDeleteKeyW RegCreateKeyExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

user32

SendMessageTimeoutW

iphlpapi

GetBestRoute GetBestInterface GetIfEntry

kernel32

SetConsoleOutputCP SetConsoleCP GetStdHandle GetConsoleMode SetConsoleMode WideCharToMultiByte CloseHandle WaitForSingleObject SetFilePointerEx FreeConsole CreateMutexW ExpandEnvironmentStringsW CreateToolhelp32Snapshot GetCurrentProcessId Process32FirstW Process32NextW OpenProcess TerminateProcess MoveFileExW SetFileInformationByHandle GetCurrentProcess GetFileInformationByHandleEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetSystemInfo GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW FindClose ReleaseMutex RtlVirtualUnwind GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc FindNextFileW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle ReadConsoleW GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetCommandLineW DeleteFileW GetFinalPathNameByHandleW SetFileAttributesW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime SwitchToThread GetLastError GetEnvironmentVariableW SetUnhandledExceptionFilter CreateMutexA IsProcessorFeaturePresent

ws2_32

connect ioctlsocket listen bind send WSACleanup WSASocketW getsockopt closesocket setsockopt WSAGetLastError WSAStartup select shutdown WSADuplicateSocketW recvfrom sendto freeaddrinfo recv accept getaddrinfo

shell32

ShellExecuteW ord680

crypt32

CertOpenSystemStoreW CertGetNameStringW CertDeleteCertificateFromStore CertCloseStore CertEnumCertificatesInStore

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile

vcruntime140

__current_exception_context memcmp memcpy memmove memset __C_specific_handler __current_exception __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_1e2d1d2059c964224861c0c8feb3b928_akira_rusty-stealer

advapi32

user32

iphlpapi

kernel32

ws2_32

shell32

crypt32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic