21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2

General

Target
2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm
Size 3.3MB
Sample260930-dpsa7add53
SHA256 21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2
MD5 361b988d9b5f67ff623d03f2f43101dc
SHA1 dc9cecfd0398661b6c03a6bc42a67c0aabcc3185
SHA512 8870b449c5811f5e70a8f6a8b1229a92e5f3e8affc4276b5453c133cf35d1921285857bf78692f38df041a00b85dda58b6d0a0cb0cacf4c5ca8cceb061a5a05a
SSDEEP 49152:jjHeohaRD3Xq/zZYGrnoHUaOgZP4QwDoit8VsOBvyXo4aFB:fiRez+x5aQjKo4
TLSH
T132F53902BE8A49E9D1CDCC74C34A8A670E2270DB1A36F6AF45C505293F6E7B55F2C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm
- Size 3.3MB
- SHA256 21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2
- MD5 361b988d9b5f67ff623d03f2f43101dc
- SHA1 dc9cecfd0398661b6c03a6bc42a67c0aabcc3185
- SHA512 8870b449c5811f5e70a8f6a8b1229a92e5f3e8affc4276b5453c133cf35d1921285857bf78692f38df041a00b85dda58b6d0a0cb0cacf4c5ca8cceb061a5a05a
- SSDEEP 49152:jjHeohaRD3Xq/zZYGrnoHUaOgZP4QwDoit8VsOBvyXo4aFB:fiRez+x5aQjKo4
- TLSH
  T132F53902BE8A49E9D1CDCC74C34A8A670E2270DB1A36F6AF45C505293F6E7B55F2C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution persistence spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing credit card regular expressions
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2