2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer
Size 75.0MB
Sample260922-ndf4wsda25
SHA256 07f482ddabb213d833a8edc41ab8ed678eb9662961755b3973386d13cd94a09a
MD5 9cff6ca3be80f01522fdc3d3854ee681
SHA1 60732c95aebe534326a1184f8c66ff40de198f57
SHA512 dcc7744d59ffb85f80df974b4bd333e1e7cffc90b06f7f9ca212cbf05ff8d72f75d3fe017790815338d174692a8e42625fa40d81ef5649961e5c61677d53d95c
SSDEEP 1572864:6zN+FA6O//pz3Rzy3GEucCpCTwVVknoeb5U4+c/8qtVo1pcoE0p:8mMdRzyWICpDvqq5PDod0p
TLSH
T102083303FF9995E9C09AC238865A5227EF72B84D0720B79B17D48A713F53B601F9D389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer

File Explorer

2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer

.exe 75.0MB

2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer

IMPHASH 8e4fe2610f8dd39cd9e2337dff6651bb
SHA256 07f482ddabb213d833a8edc41ab8ed678eb9662961755b3973386d13cd94a09a
MD5 9cff6ca3be80f01522fdc3d3854ee681
SHA1 60732c95aebe534326a1184f8c66ff40de198f57
SHA512 dcc7744d59ffb85f80df974b4bd333e1e7cffc90b06f7f9ca212cbf05ff8d72f75d3fe017790815338d174692a8e42625fa40d81ef5649961e5c61677d53d95c
SSDEEP 1572864:6zN+FA6O//pz3Rzy3GEucCpCTwVVknoeb5U4+c/8qtVo1pcoE0p:8mMdRzyWICpDvqq5PDod0p
TLSH
T102083303FF9995E9C09AC238865A5227EF72B84D0720B79B17D48A713F53B601F9D389
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f4:e5:40:4e:b9:3f:2b:fa:ea:e7:9c:80:d0:75:32:f5:bf:85:21:aa:2d:7c:93:0b:75:fd:a7:ef:ba:a2:c1:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility

Chains

Sep 22, 2026

CN=Microsoft Windows Software Compatibility

Minor OS version

Major OS version

Entry point

2640136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spongebob_launcher.pdb

kernel32

SetHandleInformation GetCurrentThreadId CreateThread WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess CreateEventW CancelIo ReadFile GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle DeleteFileW GetExitCodeProcess WaitForSingleObject PostQueuedCompletionStatus GetOverlappedResult WaitForMultipleObjects CopyFileExW FindClose LoadLibraryExA FreeLibrary FindNextFileW GetTempPathW LoadLibraryA GetCurrentProcess SetFileInformationByHandle GetModuleHandleA SetFilePointerEx GetProcAddress GetModuleHandleW IsDebuggerPresent AddVectoredExceptionHandler WaitForSingleObjectEx GetFileInformationByHandleEx GetFileInformationByHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW SetFileTime WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateFileW FindFirstFileExW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetFullPathNameW CreateDirectoryW GetCurrentProcessId HeapAlloc CreateMutexA lstrlenW ReleaseMutex SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError TerminateProcess IsProcessorFeaturePresent GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SwitchToThread HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee CloseHandle GetTickCount64 GetSystemInfo GlobalMemoryStatusEx InitializeSListHead

ws2_32

getsockopt shutdown WSASocketW closesocket ioctlsocket connect bind WSAStartup WSACleanup getaddrinfo freeaddrinfo WSAIoctl recv send setsockopt WSASend getsockname WSAGetLastError getpeername

ntdll

NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertOpenStore CryptUnprotectData CertDuplicateCertificateContext

secur32

EncryptMessage DeleteSecurityContext DecryptMessage FreeContextBuffer AcceptSecurityContext AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW ApplyControlToken

bcryptprimitives

ProcessPrng

oleaut32

SysStringLen GetErrorInfo SysFreeString

user32

GetSystemMetrics

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetKnownFolderPath

vcruntime140

__C_specific_handler memmove memcpy __CxxFrameHandler3 memcmp __current_exception memset __current_exception_context strrchr

api-ms-win-crt-string-l1-1-0

strcmp strspn strcspn strncmp wcslen strlen

api-ms-win-crt-math-l1-1-0

_dclass fabs cos log sin __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc _msize

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _endthreadex _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initterm __p___argv _initterm_e exit _exit _get_initial_narrow_environment _c_exit _cexit __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_9cff6ca3be80f01522fdc3d3854ee681_akira_glassworm_rusty-stealer

PE Signature issue

kernel32

ws2_32

ntdll

api-ms-win-core-synch-l1-2-0

crypt32

secur32

bcryptprimitives

oleaut32

user32

advapi32

shell32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic