2026-09-24_0a9dea9855ce110ddc5f9c3f67529fee_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_0a9dea9855ce110ddc5f9c3f67529fee_akira_glassworm_icedid_rusty-stealer
Size 3.4MB
Sample260925-ssnvhafb64
SHA256 ed6c5f2ad87cc635894a30af6bb79dc7f82348b6f79a589b23401378ca1a52f7
MD5 0a9dea9855ce110ddc5f9c3f67529fee
SHA1 32039813c1f90c783922cd53eb9f20d944851d06
SHA512 439ffe4e406b90dce68528170824b14cd68f67b9f67aa06708a5940a8d612f6f6fdc126dccc3ca716066dd2e95a770161fe79d8465909a30211df9493a3b8ce8
SSDEEP 49152:K1A96xEq8R/XOAv8gdnrj9X4IbvKDLOe0AExGWEm5Ud6rUAW0Y67+4IU6iI2q:KM8gXhqpmyGaH+IV
TLSH
T1A1F53A127A5B94ECD59AC4748346CA735E217CCB0B26B9EF40C47D3B3E7AAA11B3C215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-24_0a9dea9855ce110ddc5f9c3f67529fee_akira_glassworm_icedid_rusty-stealer

.exe 3.4MB

2026-09-24_0a9dea9855ce110ddc5f9c3f67529fee_akira_glassworm_icedid_rusty-stealer

IMPHASH d533d24faba3868de931a40493f6e24b
SHA256 ed6c5f2ad87cc635894a30af6bb79dc7f82348b6f79a589b23401378ca1a52f7
MD5 0a9dea9855ce110ddc5f9c3f67529fee
SHA1 32039813c1f90c783922cd53eb9f20d944851d06
SHA512 439ffe4e406b90dce68528170824b14cd68f67b9f67aa06708a5940a8d612f6f6fdc126dccc3ca716066dd2e95a770161fe79d8465909a30211df9493a3b8ce8
SSDEEP 49152:K1A96xEq8R/XOAv8gdnrj9X4IbvKDLOe0AExGWEm5Ud6rUAW0Y67+4IU6iI2q:KM8gXhqpmyGaH+IV
TLSH
T1A1F53A127A5B94ECD59AC4748346CA735E217CCB0B26B9EF40C47D3B3E7AAA11B3C215
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

41:56:e9:40:80:cf:82:dc:b9:89:bd:2b:b8:ec:c1:78:08:e1:68:b5:cf:f0:25:b6:60:f8:7b:d8:13:2f:8a:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2116572,CN=OKX Global Holding Company Limited,O=OKX Global Holding Company Limited,L=Road Town,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Chains

Aug 18, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:22:c6:c1:8f:86:bb:aa:cc:74:b3:7b:01:7e:d3:d0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 3, 2026 - Jun 2, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2044064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

OKX_Launcher.pdb

kernel32

SleepEx ReadFileEx CreateNamedPipeW CreateEventW ConnectNamedPipe SetEvent WaitForSingleObject GetOverlappedResult ResetEvent ReadFile WriteFile LoadLibraryA GetProcAddress GetCurrentProcess LoadLibraryExW GetSystemPowerStatus GetCommandLineW GetCurrentProcessId GetExitCodeProcess GetSystemDirectoryW GetUserDefaultUILanguage CreateMutexW HeapReAlloc GetSystemFirmwareTable CreateFileW DeviceIoControl GetPhysicallyInstalledSystemMemory GetCurrentThreadId GetSystemTimePreciseAsFileTime GetProcessId AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute CancelIoEx GetSystemInfo SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetConsoleOutputCP MultiByteToWideChar WriteConsoleW K32GetPerformanceInfo GetEnvironmentVariableW WriteFileEx QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter SetHandleInformation GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetFinalPathNameByHandleW MoveFileExW CreateWaitableTimerExW SetWaitableTimer Sleep GetFileType GetProcessTimes OpenProcess GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx LocalFree LoadLibraryExA FreeLibrary SetFilePointerEx HeapSize LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree GlobalMemoryStatusEx GetLastError CreateThread DisconnectNamedPipe FlushFileBuffers SwitchToThread CloseHandle HeapFree HeapAlloc GetProcessHeap FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile NtQueryInformationProcess NtOpenFile NtCreateNamedPipeFile NtQuerySystemInformation RtlGetVersion

oleaut32

GetErrorInfo SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

advapi32

GetTokenInformation OpenProcessToken RegCloseKey CopySid GetLengthSid IsValidSid SystemFunction036 RegOpenKeyExW RegQueryValueExW

user32

GetSystemMetrics EnumDisplayDevicesW MessageBoxW

ws2_32

setsockopt WSADuplicateSocketW getsockname send getaddrinfo freeaddrinfo getpeername WSARecv recv WSAGetLastError WSAStartup WSACleanup WSASend ioctlsocket connect select closesocket WSASocketW getsockopt

pdh

PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhCollectQueryData PdhAddEnglishCounterW PdhOpenQueryA

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

841KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

398KB

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_0a9dea9855ce110ddc5f9c3f67529fee_akira_glassworm_icedid_rusty-stealer

kernel32

bcryptprimitives

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

user32

ws2_32

pdh

psapi

shell32

powrprof

generic