2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer
Size 75.0MB
Sample260924-dlwt7scf37
SHA256 318c6b6883f42561267fd275b0b4d2caa0859e4e95117435ea81e5a50fa163fb
MD5 b5f0688a84a33253cc0831cc79a69511
SHA1 fe295f85a18c3fd972d0fcd00a4787fa73836c55
SHA512 303e35d049bcdc9921ce0a201719882f643c5d24f0b21dcc0161755508100591f6deed020b0581baa86e82539ce7c28de5c6615732c95e3959422ea6edf844fd
SSDEEP 1572864:iCe8stTVk0w0KiQFnbbWHAjJkRZfGgITr9u1loQpduyXt:i18aVS0KiQFnb0fUr9u1aQp8yd
TLSH
T1FF083343FA6291EDC169C038869B5633BB32BC4D47217AEB57944A323E52FE06E7C744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer

.exe 75.0MB

2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer

IMPHASH 6e9797430bb295f0d2405f323512a6d0
SHA256 318c6b6883f42561267fd275b0b4d2caa0859e4e95117435ea81e5a50fa163fb
MD5 b5f0688a84a33253cc0831cc79a69511
SHA1 fe295f85a18c3fd972d0fcd00a4787fa73836c55
SHA512 303e35d049bcdc9921ce0a201719882f643c5d24f0b21dcc0161755508100591f6deed020b0581baa86e82539ce7c28de5c6615732c95e3959422ea6edf844fd
SSDEEP 1572864:iCe8stTVk0w0KiQFnbbWHAjJkRZfGgITr9u1loQpduyXt:i18aVS0KiQFnb0fUr9u1aQp8yd
TLSH
T1FF083343FA6291EDC169C038869B5633BB32BC4D47217AEB57944A323E52FE06E7C744
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f9:56:6f:ce:d6:5e:65:40:0d:76:76:12:49:03:a3:17:04:74:59:c3:92:96:d3:2b:f3:94:d0:5d:ab:e1:37:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility

Chains

Sep 23, 2026

CN=Microsoft Windows Software Compatibility

Minor OS version

Major OS version

Entry point

2618172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spongebob_launcher.pdb

kernel32

GetFinalPathNameByHandleW SetLastError GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP SetFileCompletionNotificationModes GetACP IsValidCodePage CreateIoCompletionPort InitializeCriticalSectionEx PostQueuedCompletionStatus GetCommandLineW GetCommandLineA RtlPcToFileHeader InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetModuleHandleW GetProcAddress LeaveCriticalSection GetCurrentProcessId FindClose FindNextFileW SetFilePointerEx GetCurrentProcess SleepEx WriteFileEx GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex EnterCriticalSection HeapAlloc CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CompareStringW GetModuleHandleA GetModuleFileNameW GetTempPathW EncodePointer SetHandleInformation DeleteFileW CopyFileExW ReadFileEx CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess RtlUnwindEx IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FlushFileBuffers HeapSize LoadLibraryExA FreeLibrary VirtualProtect GetQueuedCompletionStatusEx LCMapStringW FlsFree FlsSetValue AddVectoredExceptionHandler QueryPerformanceCounter SwitchToThread HeapReAlloc FlsGetValue FlsAlloc GetFileType GetCurrentThread SetThreadStackGuarantee GetLastError CloseHandle CreateThread GetSystemTimePreciseAsFileTime HeapFree GetModuleHandleExW WriteFile LoadLibraryExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal TlsFree RaiseException TlsSetValue GetProcessHeap TlsGetValue TlsAlloc GetStartupInfoW GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

ws2_32

WSASocketW WSAIoctl bind connect getsockopt WSAStartup WSACleanup setsockopt freeaddrinfo recv closesocket send shutdown WSASend getpeername ioctlsocket getsockname WSAGetLastError getaddrinfo

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertOpenStore CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertGetCertificateChain

secur32

InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW ApplyControlToken AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeCredentialsHandle DeleteSecurityContext FreeContextBuffer

oleaut32

SysStringLen GetErrorInfo SysFreeString

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

user32

GetDC EnumDisplayMonitors SetProcessDPIAware ReleaseDC

gdi32

GetDIBits CreateCompatibleBitmap DeleteObject DeleteDC BitBlt SelectObject CreateCompatibleDC

shell32

SHGetKnownFolderPath ShellExecuteW

winsqlite3

sqlite3_errmsg sqlite3_prepare_v2 sqlite3_column_type sqlite3_initialize sqlite3_threadsafe sqlite3_config sqlite3_close sqlite3_busy_timeout sqlite3_libversion_number sqlite3_mutex_alloc sqlite3_column_int64 sqlite3_column_text sqlite3_column_bytes sqlite3_column_blob sqlite3_extended_result_codes sqlite3_bind_parameter_count sqlite3_column_double sqlite3_open_v2 sqlite3_mutex_free sqlite3_column_name sqlite3_finalize sqlite3_step sqlite3_column_count sqlite3_reset

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_b5f0688a84a33253cc0831cc79a69511_akira_glassworm_icedid_rusty-stealer

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ws2_32

ntdll

crypt32

secur32

oleaut32

advapi32

user32

gdi32

shell32

winsqlite3

generic