2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer
Size 1.4MB
Sample260924-bscc2aba57
SHA256 8bf157bc8f0911b2ae38ca6f46dd45fdcd2e475a70a912c08c841f7c2400c7e6
MD5 ce191ea6372ed4d1e727c81a00c3ebfc
SHA1 dfa6e4fbf8266b2317a574f40be1aa12cabfe16b
SHA512 17629408cfe32e2535f716bbe2e2efbe359ebd6ee55cd016de326dbe22a3f1010990429886a6f43ae3284916a19ab11c772ad7f4d5c302062995c9215a343af7
SSDEEP 24576:8JMRm+Vdv4lWsIxbJawDFx8J4gzcch86RIviYhV9bcs:8JMRmWWlWsIx9aKF2och8B9b
TLSH
T148654932F7D7C3A4C35B813C827EBD73972174C506E1A5AB269B0D212A55FB01A2B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer

.exe 1.4MB

2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer

IMPHASH 3d3562585a2979fd85bb47f633705d44
SHA256 8bf157bc8f0911b2ae38ca6f46dd45fdcd2e475a70a912c08c841f7c2400c7e6
MD5 ce191ea6372ed4d1e727c81a00c3ebfc
SHA1 dfa6e4fbf8266b2317a574f40be1aa12cabfe16b
SHA512 17629408cfe32e2535f716bbe2e2efbe359ebd6ee55cd016de326dbe22a3f1010990429886a6f43ae3284916a19ab11c772ad7f4d5c302062995c9215a343af7
SSDEEP 24576:8JMRm+Vdv4lWsIxbJawDFx8J4gzcch86RIviYhV9bcs:8JMRmWWlWsIx9aKF2och8B9b
TLSH
T148654932F7D7C3A4C35B813C827EBD73972174C506E1A5AB269B0D212A55FB01A2B63D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

362944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

enma_windows2.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

WaitForSingleObject SetFilePointerEx CloseHandle DeleteFileW SetFileInformationByHandle FindFirstFileExW GetCommandLineW GetLogicalDrives SetLastError FlushFileBuffers GetExitCodeProcess HeapSize AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetLastError GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte FindClose GetStdHandle FindNextFileW GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread LCMapStringW WaitForMultipleObjects GetTempPathW CopyFileExW CompareStringW VirtualProtect GetConsoleMode RtlVirtualUnwind InitializeCriticalSectionEx QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile NtOpenFile NtCreateNamedPipeFile

user32

GetKeyboardLayoutList SystemParametersInfoW

userenv

GetUserProfileDirectoryW

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

413KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

950KB

Virtual Size

949KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_ce191ea6372ed4d1e727c81a00c3ebfc_akira_glassworm_icedid_rusty-stealer

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

user32

userenv

bcrypt

advapi32

generic