2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer
Size 15.9MB
Sample261023-dkcd6swtbt
SHA256 f311e459a98c28d763ac5635d43d164b72fc0cce1f4145044daa191453ab3701
MD5 f0bf2c48ecd9c6ede7b48cc2a0703e84
SHA1 2026c9df7d95ea8c90907ce68e17c8e319876d91
SHA512 35d3b2471036d46ff8357ab89d0917689678f8ef8cbb088d4b49848b09a35874ab48c1030f7069c8fc71a7ce6f098b11bfb0e85709a45703464f11e8143f0327
SSDEEP 98304:UFIUHi2Iuvk7Lr3RsMVC8bMVzr3HuFPzuO+W7NMb6Dh1/YouAmOccPUTJDeQFrlr:oIDFuvAGMVCVHWNjVDK
TLSH
T1B0F6E716B76960DDC17BC07892879F22B921749D07393BF38AC1826A2F24EF4AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer

File Explorer

2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer

.exe 15.9MB

2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer

IMPHASH eb8a433fc7e4f5b17511bfaf9c2f8787
SHA256 f311e459a98c28d763ac5635d43d164b72fc0cce1f4145044daa191453ab3701
MD5 f0bf2c48ecd9c6ede7b48cc2a0703e84
SHA1 2026c9df7d95ea8c90907ce68e17c8e319876d91
SHA512 35d3b2471036d46ff8357ab89d0917689678f8ef8cbb088d4b49848b09a35874ab48c1030f7069c8fc71a7ce6f098b11bfb0e85709a45703464f11e8143f0327
SSDEEP 98304:UFIUHi2Iuvk7Lr3RsMVC8bMVzr3HuFPzuO+W7NMb6Dh1/YouAmOccPUTJDeQFrlr:oIDFuvAGMVCVHWNjVDK
TLSH
T1B0F6E716B76960DDC17BC07892879F22B921749D07393BF38AC1826A2F24EF4AD3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11222252

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

selaris_capture-e3265daaa6469301.pdb

bcryptprimitives

ProcessPrng

kernel32

GetLastError GetProcAddress GetModuleHandleA Sleep MoveFileExW CloseHandle GetFileInformationByHandle LocalFree GetModuleFileNameW GetFinalPathNameByHandleW SetLastError SetUnhandledExceptionFilter IsProcessorFeaturePresent UnhandledExceptionFilter FindNextFileW RtlLookupFunctionEntry GetSystemTimeAsFileTime TerminateProcess GetProcessId GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread GetConsoleOutputCP WriteConsoleW HeapAlloc InitializeSListHead IsDebuggerPresent RtlCaptureContext OpenProcess WaitForSingleObject RtlVirtualUnwind GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetCurrentThread FormatMessageW SetWaitableTimer CreateWaitableTimerExW LoadLibraryA GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle LockFileEx FlushFileBuffers SetFileTime DuplicateHandle SetHandleInformation AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW RemoveDirectoryW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW CreateEventW GetOverlappedResult DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFileType GetModuleHandleW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceFrequency ReadFile CancelIo

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

shell32

SHCreateItemFromParsingName

crypt32

CryptUnprotectData CryptProtectData

ole32

CoUninitialize CoTaskMemFree CoCreateInstance CoInitializeEx

ws2_32

WSACleanup connect WSAStartup closesocket WSADuplicateSocketW WSASocketW WSAGetLastError getaddrinfo freeaddrinfo getsockopt setsockopt ioctlsocket accept recv send getpeername getsockname bind listen WSARecv WSASend select

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception __C_specific_handler memcpy __CxxFrameHandler3 _CxxThrowException memset memcmp memmove

api-ms-win-crt-math-l1-1-0

sinf expf ceilf fmod powf floorf truncf cos roundf sin floor __setusermatherr cosf _hypotf atan2f

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_f0bf2c48ecd9c6ede7b48cc2a0703e84_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

shell32

crypt32

ole32

ws2_32

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic