2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer
Size 75.0MB
Sample260930-e6vcjsxdre
SHA256 3b56789805a8b84344bd5164fd8617e14aea6b65bfb6bb2a1028f205200eb829
MD5 200e38b3cf28fd49b45e85b94b6517eb
SHA1 ad85e7cea19f883b1c7bc3a54520fbfabdf98fe7
SHA512 92eb9321d7ce5193948b80ed6ebfcd088254c10ee447c460485c6c6dafff8b6953a83617e33f4f0e5f6572cb2d49bc2d11ffe2f4c954561f3e66b932a8f057c4
SSDEEP 1572864:PwjzgXUu0FDjgj0LPTXBHVC1YzK8uEWRWvnJLh6U5WmuVkK468DHcHHi4XMkk:Pwj20xjgj0TTvAQK8RWIxkIuV78DHcHG
TLSH
T148083383F6A690FDC56AC038934A6233BB36788907317AFB56949A353E51BD02F3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer

File Explorer

2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer

.exe 75.0MB

2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer

IMPHASH 37f52427d075a305544b84355ca5454d
SHA256 3b56789805a8b84344bd5164fd8617e14aea6b65bfb6bb2a1028f205200eb829
MD5 200e38b3cf28fd49b45e85b94b6517eb
SHA1 ad85e7cea19f883b1c7bc3a54520fbfabdf98fe7
SHA512 92eb9321d7ce5193948b80ed6ebfcd088254c10ee447c460485c6c6dafff8b6953a83617e33f4f0e5f6572cb2d49bc2d11ffe2f4c954561f3e66b932a8f057c4
SSDEEP 1572864:PwjzgXUu0FDjgj0LPTXBHVC1YzK8uEWRWvnJLh6U5WmuVkK468DHcHHi4XMkk:Pwj20xjgj0TTvAQK8RWIxkIuV78DHcHG
TLSH
T148083383F6A690FDC56AC038934A6233BB36788907317AFB56949A353E51BD02F3D705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

04:c4:96:91:49:b9:86:f5:5c:24:e4:b4:05:1d:b2:9a:ef:68:58:30:a4:58:18:79:27:a0:7b:8e:ad:ab:f9:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility

Chains

Sep 25, 2026

CN=Microsoft Windows Software Compatibility

Minor OS version

Major OS version

Entry point

2133836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spongebob_launcher.pdb

kernel32

GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort InitializeCriticalSectionEx PostQueuedCompletionStatus GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage CompareStringW GetQueuedCompletionStatusEx LCMapStringW GetCommandLineW GetCommandLineA RtlPcToFileHeader InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleHandleW GetProcAddress LeaveCriticalSection GetCurrentProcessId FindClose GetModuleHandleA SetFilePointerEx GetCurrentProcess SleepEx WriteFileEx ReadFileEx GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex EnterCriticalSection HeapAlloc CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx RaiseException GetModuleFileNameW GetTempPathW EncodePointer SetHandleInformation DeleteFileW CopyFileExW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess RtlUnwindEx IsDebuggerPresent FindNextFileW InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FlushFileBuffers HeapSize LoadLibraryExA FreeLibrary VirtualProtect SwitchToThread HeapReAlloc FlsFree GetCurrentThread FlsSetValue SetThreadStackGuarantee GetLastError WaitForSingleObject AddVectoredExceptionHandler QueryPerformanceCounter FlsGetValue FlsAlloc GetFileType SetWaitableTimer Sleep CreateWaitableTimerExW CloseHandle CreateThread GetSystemTimePreciseAsFileTime HeapFree GetModuleHandleExW WriteFile LoadLibraryExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal TlsFree SetFileTime TlsSetValue GetProcessHeap TlsGetValue TlsAlloc GetStartupInfoW GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ws2_32

WSASocketW WSAIoctl bind connect getsockopt WSAStartup WSACleanup setsockopt freeaddrinfo recv closesocket send shutdown WSASend getpeername ioctlsocket getsockname WSAGetLastError getaddrinfo

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

crypt32

CertAddCertificateContextToStore CertOpenStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore

secur32

InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW ApplyControlToken AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeCredentialsHandle DeleteSecurityContext FreeContextBuffer

oleaut32

SysStringLen GetErrorInfo SysFreeString

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

user32

GetDC EnumDisplayMonitors SetProcessDPIAware ReleaseDC

gdi32

GetDIBits DeleteObject BitBlt CreateCompatibleDC SelectObject CreateCompatibleBitmap DeleteDC

shell32

SHGetKnownFolderPath ShellExecuteW

winsqlite3

sqlite3_errmsg sqlite3_prepare_v2 sqlite3_column_type sqlite3_initialize sqlite3_threadsafe sqlite3_config sqlite3_close sqlite3_busy_timeout sqlite3_libversion_number sqlite3_mutex_alloc sqlite3_column_int64 sqlite3_column_text sqlite3_column_bytes sqlite3_column_blob sqlite3_extended_result_codes sqlite3_bind_parameter_count sqlite3_column_double sqlite3_open_v2 sqlite3_mutex_free sqlite3_column_name sqlite3_finalize sqlite3_column_count sqlite3_reset sqlite3_step

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

756KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_200e38b3cf28fd49b45e85b94b6517eb_akira_glassworm_icedid_rusty-stealer

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ws2_32

ntdll

crypt32

secur32

oleaut32

advapi32

user32

gdi32

shell32

winsqlite3

generic