b0f33a982d4cab219b1bb4e5464a5360f995c8855da0dbdcdaa1817a1e755487

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe
Size 11.0MB
Sample261006-vbabwsssbz
SHA256 b0f33a982d4cab219b1bb4e5464a5360f995c8855da0dbdcdaa1817a1e755487
MD5 b357eb89f2b71d3e75d9fc1071075598
SHA1 4ee82358d41fca66003503f27c6c0f6947d1c57f
SHA512 0b0ab706d43d34fc424145b989abb1250942e7410d9d0214c090c235bcf5061bce38cd91fa612145f64dfc686e9e443bfa86c95167c219eabcb56a4d65489f9e
SSDEEP 98304:0nhOGiHY4WSW4ixWkNR7O1MdopbYD8jZrpESh:SOG/4hWxRmrpESh
TLSH
T109C6B5296679A0D9C17BC0B892878F61BE2170D90B393BF744D1827A2F24EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe
3036	2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updates.json

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-3036-1791305316848266100-0\updates.json
Size 20B
SHA256 8f99292b617bbb5f2f15f17fc5d4d9df5b839f7a5b593cbacd8842fb69f37ce5
MD5 138b9d10b8bb1e8b8bb96a45a67e9046
SHA1 95c4d589311ac9b3ecf82c04de1d381e8c9452bb
SHA512 7cbc0e064ce0c62ea4329619e6df5e61d882919e63302cb5d39dab74d026d7a960c2d61107760b53ad1959ea03325089eda40de457f2dc78cc9bc85b819a24d7
MD5 SHA1 SHA512

Submit Download

updates.json.tmp

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-3036-1791305316848266100-0\updates.json.tmp
Size 19B
SHA256 7850de8e7684b48649545415c91a8fb5d970b6dae70a66e1f89ea28a51cacb01
MD5 9bc95d7e11124ef3fd43e8cb2f3c3714
SHA1 8528e96cfcd441ef51faf7b071595833d40ecf70
SHA512 58e0108663b834dd8183830dff13189e8e06613af9bc1a4e980658a23990f1053ccf158c3cec527310e5a25fc949dd2bab9dc1f8e3f3d1e36db9e23c7ebf113c
MD5 SHA1 SHA512

Submit Download