2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer
Size 9.2MB
Sample261023-gd4fvsb17p
SHA256 439aa8d660c9cc9574057c69338f81a166b1b2c4243a27b3e677d48bc158ec9a
MD5 f4fae96721d3be6dbd4677594316d661
SHA1 94a2ed1d0746625c44002da378beb5bc600997c0
SHA512 fb56ab3af3437d4ee9a23024255854b85b957399369c691a1379940c4b384529ff556f40a24136213ed8be356ce627b0bfed3275aec14b57c3cedba7834f63e2
SSDEEP 98304:nYvdDEPiIss//1uAv7C4OfJIA+NaA2c+1JbQxH7T:nYvd4PiAYJbS3
TLSH
T14AA6B426667CA0EDD17BC0B882838F616D2130DA0B392FF744D1867A2F25EF9693D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer

File Explorer

2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer

.exe 9.2MB

2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer

IMPHASH ef29e3c8e88b26053b240e415bafb628
SHA256 439aa8d660c9cc9574057c69338f81a166b1b2c4243a27b3e677d48bc158ec9a
MD5 f4fae96721d3be6dbd4677594316d661
SHA1 94a2ed1d0746625c44002da378beb5bc600997c0
SHA512 fb56ab3af3437d4ee9a23024255854b85b957399369c691a1379940c4b384529ff556f40a24136213ed8be356ce627b0bfed3275aec14b57c3cedba7834f63e2
SSDEEP 98304:nYvdDEPiIss//1uAv7C4OfJIA+NaA2c+1JbQxH7T:nYvd4PiAYJbS3
TLSH
T14AA6B426667CA0EDD17BC0B882838F616D2130DA0B392FF744D1867A2F25EF9693D754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7231880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-861181dc122f9ad2.pdb

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

CreateEventW GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx CreateFileW GetCurrentProcessId WaitForSingleObject ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess SetFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FreeEnvironmentStringsW GetLastError CancelIo GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetEnvironmentStringsW CompareStringOrdinal LoadLibraryA GetStdHandle CreateDirectoryW IsProcessorFeaturePresent AddVectoredExceptionHandler SetFileInformationByHandle GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetProcessHeap HeapFree CopyFileExW FindFirstFileExW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeviceIoControl GetModuleHandleA DeleteFileW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW SetCurrentDirectoryW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetModuleHandleW FormatMessageW HeapReAlloc WaitForMultipleObjects GetProcAddress SetThreadStackGuarantee GetSystemTimeAsFileTime GetConsoleMode GetFileInformationByHandle GetNativeSystemInfo InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileSizeEx GetFileAttributesW FindNextFileW CreateThread FindFirstFileW FindClose CloseHandle lstrlenW QueryPerformanceCounter DuplicateHandle SetFilePointerEx

ole32

CoCreateInstance CoInitializeEx CoInitialize

oleaut32

SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

RegOpenKeyExW RegCloseKey RegEnumKeyExW RegOpenKeyExA RegQueryValueExW

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

memset __CxxFrameHandler3 memcpy memcmp memmove wcschr _CxxThrowException __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-string-l1-1-0

wcslen _wcsdup

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

fclose _set_fmode __p__commode _get_osfhandle fgetws _wfopen_s __stdio_common_vswscanf _fileno

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe _crt_atexit exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit terminate _c_exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_f4fae96721d3be6dbd4677594316d661_akira_rusty-stealer

shell32

combase

kernel32

ole32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic