2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer
Size 6.0MB
Sample261006-v2thfsswd1
SHA256 667ae1f9cca7d0c614e673bd08ac1d0fc408217244cc1ac0f2ee0e2b1ccdfe6e
MD5 aa91be72af25a0f3cafc3242983ac068
SHA1 0e7b36b8035dba9ed0f1f4289bb6759089e1a673
SHA512 31ed013f0e55e8595ec547bdc81477e654b0ffd3eca7e957fada1f2c48958303451104db7261ac993768f52988c206216978b95ac9e90f734e82e4024c849ad9
SSDEEP 49152:j/3ajqfpjyE5pQ0Hk7ZMrHhl8+YP8MnWSsnBeiAwgJuNmEHjRfe3bbIyxWbRhwpV:rHg8UiYLz78a
TLSH
T19056A42A6669A0DDC17BC0B8D2878F62A92174DD0B393BF345D182792F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer

File Explorer

2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer

.exe 6.0MB

2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer

IMPHASH 46d3a5a94f0f5b13b269ed7b4a8b620b
SHA256 667ae1f9cca7d0c614e673bd08ac1d0fc408217244cc1ac0f2ee0e2b1ccdfe6e
MD5 aa91be72af25a0f3cafc3242983ac068
SHA1 0e7b36b8035dba9ed0f1f4289bb6759089e1a673
SHA512 31ed013f0e55e8595ec547bdc81477e654b0ffd3eca7e957fada1f2c48958303451104db7261ac993768f52988c206216978b95ac9e90f734e82e4024c849ad9
SSDEEP 49152:j/3ajqfpjyE5pQ0Hk7ZMrHhl8+YP8MnWSsnBeiAwgJuNmEHjRfe3bbIyxWbRhwpV:rHg8UiYLz78a
TLSH
T19056A42A6669A0DDC17BC0B8D2878F62A92174DD0B393BF345D182792F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4671228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

RtlNtStatusToDosError NtQueryInformationProcess NtReadFile NtSetInformationProcess NtCreateNamedPipeFile NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime CreateToolhelp32Snapshot GetCurrentProcess CreateFileW GetDriveTypeW GetFileAttributesW GetVolumePathNameW GetDiskFreeSpaceExW GetFileAttributesExW GetVolumeInformationW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileInformationByHandleEx GetVolumeNameForVolumeMountPointW ReadProcessMemory GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx CloseHandle FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW Process32NextW Process32FirstW ProcessIdToSessionId GetLogicalDriveStringsW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

advapi32

RegOpenKeyExW RegGetValueW RegCloseKey GetLengthSid GetTokenInformation RegQueryValueExW OpenProcessToken

user32

GetForegroundWindow GetWindowThreadProcessId

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

psapi

EmptyWorkingSet GetProcessMemoryInfo EnumPageFilesW GetPerformanceInfo

gdi32

CreateCompatibleDC DeleteDC

pdh

PdhCloseQuery

propsys

VariantToBoolean

oleaut32

VariantClear SysStringLen GetErrorInfo SysAllocStringLen SysFreeString

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 __current_exception_context memset __current_exception memcmp memmove _CxxThrowException memcpy __C_specific_handler

api-ms-win-crt-math-l1-1-0

trunc fmod floor __setusermatherr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _set_app_type _crt_atexit _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment terminate _initialize_narrow_environment _register_onexit_function _c_exit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_aa91be72af25a0f3cafc3242983ac068_akira_rusty-stealer

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

user32

ole32

psapi

gdi32

pdh

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic