2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer
Size 11.0MB
Sample261006-vbabwsssbz
SHA256 b0f33a982d4cab219b1bb4e5464a5360f995c8855da0dbdcdaa1817a1e755487
MD5 b357eb89f2b71d3e75d9fc1071075598
SHA1 4ee82358d41fca66003503f27c6c0f6947d1c57f
SHA512 0b0ab706d43d34fc424145b989abb1250942e7410d9d0214c090c235bcf5061bce38cd91fa612145f64dfc686e9e443bfa86c95167c219eabcb56a4d65489f9e
SSDEEP 98304:0nhOGiHY4WSW4ixWkNR7O1MdopbYD8jZrpESh:SOG/4hWxRmrpESh
TLSH
T109C6B5296679A0D9C17BC0B892878F61BE2170D90B393BF744D1827A2F24EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer

File Explorer

2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer

.exe 11.0MB

2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer

IMPHASH fb772f8fe18a9ae5f5174a1cf6c8f96b
SHA256 b0f33a982d4cab219b1bb4e5464a5360f995c8855da0dbdcdaa1817a1e755487
MD5 b357eb89f2b71d3e75d9fc1071075598
SHA1 4ee82358d41fca66003503f27c6c0f6947d1c57f
SHA512 0b0ab706d43d34fc424145b989abb1250942e7410d9d0214c090c235bcf5061bce38cd91fa612145f64dfc686e9e443bfa86c95167c219eabcb56a4d65489f9e
SSDEEP 98304:0nhOGiHY4WSW4ixWkNR7O1MdopbYD8jZrpESh:SOG/4hWxRmrpESh
TLSH
T109C6B5296679A0D9C17BC0B892878F61BE2170D90B393BF744D1827A2F24EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8499868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_governor_lib-2c15564d16cf4072.pdb

bcryptprimitives

ProcessPrng

advapi32

IsValidAcl GetAclInformation GetAce IsValidSid IsWellKnownSid GetSecurityDescriptorControl RegDeleteTreeW RegCreateKeyExW RegOpenKeyTransactedW RegCloseKey RegOpenKeyExW RegQueryValueExW RegFlushKey GetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation RegSetValueExW OpenProcessToken

ktmw32

CommitTransaction CreateTransaction RollbackTransaction

kernel32

SetConsoleTextAttribute GetConsoleScreenBufferInfo MoveFileExW CreateFileW GetModuleFileNameW GetVolumeInformationByHandleW CreateEventW LocalFree GetStdHandle GetCurrentProcess GetWindowsDirectoryW GetTickCount64 GetModuleHandleA Sleep GetProcAddress LoadLibraryExA FormatMessageW GetLastError HeapFree HeapAlloc GetProcessHeap CloseHandle LoadLibraryA GetModuleHandleW GetSystemTimeAsFileTime lstrlenW IsDebuggerPresent GetCurrentThreadId CreateDirectoryW ReplaceFileW IsProcessorFeaturePresent WaitForSingleObject GetConsoleMode GetFileInformationByHandle GetFileAttributesW GetOverlappedResult ReadFile GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead SystemTimeToFileTime FileTimeToSystemTime GetEnvironmentVariableW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFileAttributesExW GetVolumeInformationW GetFinalPathNameByHandleW GetFileInformationByHandleEx GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetSystemInfo GetNativeSystemInfo CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW RemoveDirectoryW FindFirstFileExW FindNextFileW GetTempPathW WaitForMultipleObjects GetFileType SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar DeleteFileW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess CreateHardLinkW FindClose

oleaut32

VariantClear SysFreeString GetErrorInfo SysStringLen SysAllocStringLen

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ole32

PropVariantClear CoCreateInstance CoCreateGuid CoSetProxyBlanket CoInitializeEx CoUninitialize

propsys

VariantToPropVariant PropVariantToBSTR

psapi

GetPerformanceInfo EnumPageFilesW

wevtapi

EvtOpenPublisherMetadata EvtGetEventMetadataProperty EvtNext EvtOpenEventMetadataEnum EvtNextEventMetadata EvtClose EvtCreateRenderContext EvtRender EvtQuery

userenv

GetUserProfileDirectoryW

vcruntime140

memcpy __CxxFrameHandler3 memcmp memset memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr pow floor

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit exit _register_thread_local_exe_atexit_callback _configure_narrow_argv terminate _set_app_type _seh_filter_exe _get_initial_narrow_environment _initterm _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _initterm_e _exit _initialize_narrow_environment __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_b357eb89f2b71d3e75d9fc1071075598_akira_glassworm_rusty-stealer

bcryptprimitives

advapi32

ktmw32

kernel32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

ole32

propsys

psapi

wevtapi

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic