2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer
Size 12.0MB
Sample260930-e44hfasz3j
SHA256 5694172ff7b78e91033afc662451d06718133e61f3899202a0d6c690903fecbb
MD5 20ce6dd85485ae2e25e652409a9ac51b
SHA1 c985bb342abdbb0d18f8d01a7b96c19f5514a819
SHA512 58b1067bdc0d4321528d85113deba75fef1776e31b8bea0d931fb52c011859c85579a3639e2bdeeae5849e0ebce10750a9f0d1806953f412518db6ef01e5db73
SSDEEP 98304:q3D4B+31CVTkGKHKtPtr+ACe+YrIdpomTG:q3aNPlLNmT
TLSH
T1B1C6F8266669A0D9D1BBC0B8C2835F22BD2170D907397BF755C4827A2F24EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer

File Explorer

2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer

.exe 12.0MB

2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer

IMPHASH 27557f03161e40ab1fab9b196dd235a5
SHA256 5694172ff7b78e91033afc662451d06718133e61f3899202a0d6c690903fecbb
MD5 20ce6dd85485ae2e25e652409a9ac51b
SHA1 c985bb342abdbb0d18f8d01a7b96c19f5514a819
SHA512 58b1067bdc0d4321528d85113deba75fef1776e31b8bea0d931fb52c011859c85579a3639e2bdeeae5849e0ebce10750a9f0d1806953f412518db6ef01e5db73
SSDEEP 98304:q3D4B+31CVTkGKHKtPtr+ACe+YrIdpomTG:q3aNPlLNmT
TLSH
T1B1C6F8266669A0D9D1BBC0B8C2835F22BD2170D907397BF755C4827A2F24EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8618512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iron_fist.pdb

bcryptprimitives

ProcessPrng

kernel32

SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetStdHandle GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime GetOverlappedResult ReadFile RtlVirtualUnwind GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetLastError SetFileInformationByHandle DuplicateHandle CloseHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort SetFileCompletionNotificationModes CopyFileExW MoveFileExW CreateDirectoryW GetFileInformationByHandleEx IsDebuggerPresent SwitchToThread CreateFileW CreateEventW GetFileInformationByHandle DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW FindClose GetFileType RaiseException GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW FormatMessageW ExitProcess WaitForMultipleObjects ReadFileEx SleepEx QueryPerformanceFrequency VirtualQuery CancelIo FreeLibrary UnhandledExceptionFilter HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry FindNextFileW SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead SetHandleInformation WaitForSingleObjectEx

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

secur32

InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext FreeContextBuffer DecryptMessage EncryptMessage ApplyControlToken FreeCredentialsHandle AcquireCredentialsHandleA QueryContextAttributesW

crypt32

CertCloseStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertDuplicateCertificateContext

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

ws2_32

connect WSASocketW WSAStartup send recv bind WSAIoctl WSASend ioctlsocket getsockname getpeername setsockopt getsockopt closesocket freeaddrinfo WSACleanup getaddrinfo WSAGetLastError shutdown

ntdll

NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

vcruntime140

memmove memset memcmp __CxxFrameHandler3 memcpy _CxxThrowException __C_specific_handler __current_exception __current_exception_context __C_specific_handler_noexcept __vcrt_GetModuleFileNameW __vcrt_LoadLibraryExW

api-ms-win-crt-math-l1-1-0

__setusermatherr log2

api-ms-win-crt-string-l1-1-0

strcat_s wcslen strcpy_s

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initialize_narrow_environment exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _crt_atexit _set_app_type _initterm_e _seh_filter_exe terminate _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_20ce6dd85485ae2e25e652409a9ac51b_akira_coinminer_glassworm_rusty-stealer

bcryptprimitives

kernel32

shell32

combase

secur32

crypt32

advapi32

ws2_32

ntdll

bcrypt

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic