2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer
Size 17.0MB
Sample261003-k4cbvaveme
SHA256 897f94ab3ad6ee1a0a40922614d06a17f71bc4292313ee1692157bd84454e2cd
MD5 80cf9358a13899c65a15e3e3a4bcb8d8
SHA1 a030420bf611be037903962d21b70065eb4e184d
SHA512 82e69ef2da2100ea7cfb694485b0841801dbc586039ccf2d74fde313bf77a1382c7a792df19e0f944a7ac7c61fcc1772250f2ad57105d0f548f5474d3006fb2d
SSDEEP 49152:BAhIOQH6sPpWAlTSV+jpxY9fXft4IzcKPU3v2hTtLDrGs+o80w:1TSVkycQ3k
TLSH
T1D307CF0A2D311BC5A604EA8735F101D72F7120F966B97EA99E4986BC3302CEDF779913
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer

File Explorer

2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer

.exe 17.0MB

2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer

IMPHASH 8516e5fc72c70c0cec880fd3cf10ed96
SHA256 897f94ab3ad6ee1a0a40922614d06a17f71bc4292313ee1692157bd84454e2cd
MD5 80cf9358a13899c65a15e3e3a4bcb8d8
SHA1 a030420bf611be037903962d21b70065eb4e184d
SHA512 82e69ef2da2100ea7cfb694485b0841801dbc586039ccf2d74fde313bf77a1382c7a792df19e0f944a7ac7c61fcc1772250f2ad57105d0f548f5474d3006fb2d
SSDEEP 49152:BAhIOQH6sPpWAlTSV+jpxY9fXft4IzcKPU3v2hTtLDrGs+o80w:1TSVkycQ3k
TLSH
T1D307CF0A2D311BC5A604EA8735F101D72F7120F966B97EA99E4986BC3302CEDF779913
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2199804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

meshpool_miner.pdb

kernel32

GetModuleHandleW WriteFileEx ExitProcess GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess SleepEx ReadFileEx HeapAlloc WriteConsoleW SetThreadErrorMode SetHandleInformation GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx GetCurrentThreadId FreeLibrary GetProcAddress CreateDirectoryW ReleaseSemaphore GetCurrentThread SetThreadStackGuarantee HeapReAlloc GetFileInformationByHandleEx SetLastError GetCurrentProcess VirtualProtect GetModuleHandleA GetSystemInfo GetSystemTimePreciseAsFileTime SetConsoleMode GetConsoleMode GetStdHandle VirtualAlloc SetConsoleCtrlHandler GetLastError CreateEventW GetFullPathNameW CancelIo WaitForSingleObject GetOverlappedResult SwitchToThread VirtualFree GetLargePageMinimum ReadFile HeapFree CreateFileW GetFileInformationByHandle GetFileType Sleep SetWaitableTimer CreateWaitableTimerExW SetFileTime SetFileInformationByHandle GetTempPathW FindFirstFileExW LoadLibraryExW CreateThread CloseHandle GetExitCodeProcess WaitForMultipleObjects FindClose DuplicateHandle GetModuleFileNameW GetFileAttributesW CreateProcessW GetWindowsDirectoryW CreateSemaphoreA GetSystemDirectoryW GetProcessHeap lstrlenW CompareStringOrdinal FlushInstructionCache AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

setsockopt send select ioctlsocket shutdown WSAStartup WSACleanup WSASocketW WSADuplicateSocketW recv getsockopt WSAGetLastError closesocket getaddrinfo freeaddrinfo connect

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140

__CxxFrameHandler3 memcpy __C_specific_handler memset memmove memcmp _CxxThrowException _purecall __current_exception_context __std_exception_copy __std_exception_destroy __current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

floor ceil log fmaf __setusermatherr round

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _errno _set_app_type __p___argc _wassert _invoke_watson _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _exit __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e exit _initialize_onexit_table _register_onexit_function terminate _crt_atexit

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh _aligned_free free _aligned_malloc malloc

api-ms-win-crt-utility-l1-1-0

_rotr64 _rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14.7MB

Virtual Size

14.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_80cf9358a13899c65a15e3e3a4bcb8d8_akira_coinminer_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

bcryptprimitives

ntdll

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic