2026-10-23_c93eabd034b5d932ccefd4dd207b6252_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_c93eabd034b5d932ccefd4dd207b6252_akira_glassworm_rusty-stealer
Size 22.1MB
Sample261023-jcpmesav41
SHA256 a07e4f948c993e40e912e0848cb168a34525284f87353b32d369856980072f47
MD5 c93eabd034b5d932ccefd4dd207b6252
SHA1 a9610b84982382ee87da64d1ad1270c63e3605cf
SHA512 00c98ec69441b368c6764907dfc0da46d6ec87673eb853562e075df8ca093f7ee9899f549cabee084a5d30c3398a3b71af11c3db5c177d9592c820fe63023596
SSDEEP 196608:4t3ja0PV6PE9Ge+EDgu2dauCOYEd0Ye8Qqjd5SZNDF1+Q:4t3ja0PV6PE9GkDuauCOYEdIWSZNR1+Q
TLSH
T1203708247A5A996CD09BC47483878AA35A7030DF0B3979FF4484963C2F79BF56F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-23_c93eabd034b5d932ccefd4dd207b6252_akira_glassworm_rusty-stealer

.exe 22.1MB

2026-10-23_c93eabd034b5d932ccefd4dd207b6252_akira_glassworm_rusty-stealer

IMPHASH c20afbec05ba1f4b50de2c83ed9f0f5d
SHA256 a07e4f948c993e40e912e0848cb168a34525284f87353b32d369856980072f47
MD5 c93eabd034b5d932ccefd4dd207b6252
SHA1 a9610b84982382ee87da64d1ad1270c63e3605cf
SHA512 00c98ec69441b368c6764907dfc0da46d6ec87673eb853562e075df8ca093f7ee9899f549cabee084a5d30c3398a3b71af11c3db5c177d9592c820fe63023596
SSDEEP 196608:4t3ja0PV6PE9Ge+EDgu2dauCOYEd0Ye8Qqjd5SZNDF1+Q:4t3ja0PV6PE9GkDuauCOYEdIWSZNR1+Q
TLSH
T1203708247A5A996CD09BC47483878AA35A7030DF0B3979FF4484963C2F79BF56F38219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

47:d7:f0:2d:50:45:61:6f:9a:39:5d:eb:38:58:a1:5d:86:bf:aa:c6:9a:4f:06:f4:0c:59:d3:f1:99:98:03:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Aurelio Avila,O=Aurelio Avila,L=Palermo,ST=Sicilia,C=IT

Chains

Oct 17, 2026

CN=Aurelio Avila,O=Aurelio Avila,L=Palermo,ST=Sicilia,C=IT

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Aurelio Avila,O=Aurelio Avila,L=Palermo,ST=Sicilia,C=IT

Serial Number

7b:1b:77:f7:68:5b:59:4e:96:be:1c:15:4a:3c:bd:12

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 5, 2026 - Sep 5, 2027

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

16143028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tauri_app.pdb

bcryptprimitives

ProcessPrng

kernel32

Sleep GetModuleHandleA LockFile GetLogicalDrives QueryDosDeviceW OpenProcess GetProcessTimes GetPriorityClass SetPriorityClass GetDriveTypeW LocalFree GetSystemCpuSetInformation GetLastError IsProcessorFeaturePresent ReleaseSRWLockExclusive MoveFileExW SetFilePointer GetModuleHandleW GetUserDefaultUILanguage LCIDToLocaleName OutputDebugStringA GetFullPathNameA AcquireSRWLockExclusive WakeAllConditionVariable GetProcAddress SleepConditionVariableSRW IsDebuggerPresent RtlPcToFileHeader EncodePointer TlsAlloc GetDiskFreeSpaceW HeapCreate SetEndOfFile TlsGetValue TlsSetValue TlsFree GetTempPathW GetCurrentThreadId GetCurrentProcess LoadLibraryExW FreeLibrary GetCurrentThread ReleaseMutex HeapAlloc HeapFree lstrlenW GetProcessHeap SetProcessDefaultCpuSets GetSystemDirectoryW GetWindowsDirectoryW GetProcessDefaultCpuSets GetLogicalProcessorInformationEx GetExitCodeProcess GetProcessInformation SetProcessInformation GetFullPathNameW WaitForSingleObject GetSystemInfo GetTickCount64 CloseHandle GlobalMemoryStatusEx GetCurrentProcessId SetHandleInformation GetDiskFreeSpaceExW SetFileCompletionNotificationModes GetFileAttributesW GetModuleFileNameW HeapCompact HeapDestroy GetVolumeInformationW UnmapViewOfFile HeapValidate UnlockFile GetFileSize AreFileApisANSI FindFirstVolumeW HeapSize FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW LoadLibraryExA WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA MapViewOfFile CreateMutexW GetTickCount FlushFileBuffers MultiByteToWideChar CreateFileW DeviceIoControl SetEvent LoadLibraryW GetTempPathA FormatMessageW GetDiskFreeSpaceA CreateEventW LockFileEx CreateFileA UnlockFileEx WriteFile ReadFile GetFileAttributesA SetNamedPipeHandleState GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetConsoleMode GetFileInformationByHandle GetQueuedCompletionStatusEx CancelIoEx GetOverlappedResult PostQueuedCompletionStatus CreateIoCompletionPort FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError SetFileInformationByHandle SetFileTime CreateThread ReadFileEx DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx CreateProcessW TerminateProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCommandLineW RemoveDirectoryW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread CreateMutexA GetFinalPathNameByHandleW CreateSymbolicLinkW SetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer WaitForMultipleObjects FindNextFileW GetEnvironmentVariableW RtlVirtualUnwind DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection UnhandledExceptionFilter SystemTimeToFileTime CreateFileMappingW GetSystemPowerStatus SetUnhandledExceptionFilter InitializeSListHead RtlUnwindEx InitializeCriticalSectionAndSpinCount K32GetPerformanceInfo ProcessIdToSessionId K32GetDeviceDriverBaseNameW K32EnumDeviceDrivers QueryPerformanceCounter QueryPerformanceFrequency CompareStringOrdinal GetCurrentDirectoryW

advapi32

AdjustTokenPrivileges RevertToSelf GetTokenInformation OpenProcessToken EqualSid LookupPrivilegeValueW OpenThreadToken RegEnumValueW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegDeleteValueW RegQueryValueExW ImpersonateSelf RegDeleteTreeW RegCloseKey RegCreateKeyTransactedW RegOpenKeyTransactedW RegEnumKeyExW RegGetValueW StartServiceW EventWriteTransfer EventSetInformation EventRegister SystemFunction036 ProcessTrace QueryServiceStatusEx ControlService ChangeServiceConfig2W ChangeServiceConfigW QueryServiceConfig2W QueryServiceConfigW OpenTraceW EnableTraceEx2 StartTraceW CloseTrace ControlTraceW QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle EventUnregister

ntdll

NtCreateFile NtSetSystemInformation NtDeviceIoControlFile NtQuerySystemInformation NtReadFile NtWriteFile RtlNtStatusToDosError NtOpenFile RtlGetVersion NtCancelIoFileEx NtCreateNamedPipeFile

user32

TrackPopupMenu ChangeWindowMessageFilterEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DestroyAcceleratorTable RegisterClassW FlashWindowEx InvalidateRgn GetWindowPlacement SetWindowPlacement KillTimer CreateAcceleratorTableW SetMenu LoadImageW SetTimer AllowSetForegroundWindow GetIconInfo InsertMenuW GetMenuItemInfoW GetMonitorInfoW MonitorFromWindow GetCursorPos AppendMenuW GetShellWindow DrawMenuBar DestroyIcon ChangeDisplaySettingsExW FindWindowW CreateMenu PostQuitMessage GetWindowLongPtrW CreatePopupMenu CreateIcon GetAsyncKeyState GetKeyboardState GetKeyState MapVirtualKeyExW ToUnicodeEx SetWindowLongPtrW DestroyMenu RemoveMenu CheckMenuItem GetMenuBarInfo OffsetRect IsProcessDPIAware GetWindowDC GetDC ReleaseDC IsWindowEnabled SystemParametersInfoA SetPropW GetMenu EnableWindow SetWindowRgn FindWindowExW GetParent GetWindowRect EnumDisplaySettingsW GetSystemMenu IsWindowVisible EnumDisplayDevicesW ShowWindow SetFocus MapWindowPoints SetParent GetWindow RegisterWindowMessageA DrawTextW RegisterRawInputDevices SetMenuItemInfoW DrawIconEx GetMessageA SystemParametersInfoW SetCursor MonitorFromRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent FillRect GetRawInputData ClientToScreen GetClientRect GetWindowLongW ScreenToClient TranslateMessage AdjustWindowRectEx GetUpdateRect MapVirtualKeyW ValidateRect DispatchMessageA MsgWaitForMultipleObjectsEx RegisterTouchWindow GetSystemMetrics DefWindowProcW GetKeyboardLayout SendInput SetForegroundWindow PostThreadMessageW PeekMessageW LoadCursorW PostMessageW DispatchMessageW GetMessageW IsIconic SendMessageW EnumChildWindows EnumDisplayMonitors MonitorFromPoint SetWindowPos CreateWindowExW RegisterClassExW SetWindowTextW SetCapture RedrawWindow AdjustWindowRect GetWindowTextW VkKeyScanW GetWindowTextLengthW TranslateAcceleratorW DestroyWindow SetWindowDisplayAffinity ClipCursor GetClipCursor GetWindowThreadProcessId GetForegroundWindow ShowCursor SetWindowLongW EnableMenuItem ReleaseCapture

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

propsys

VariantGetStringElem VariantToUInt32 VariantGetElementCount

combase

CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

ole32

CoCreateInstance CoInitialize RevokeDragDrop RegisterDragDrop CoUninitialize CoInitializeEx OleInitialize CoSetProxyBlanket

gdi32

DeleteDC CombineRgn SelectObject SetTextColor SetBkMode GetObjectW CreateSolidBrush GetDIBits CreateCompatibleDC GetDeviceCaps CreateRectRgn BitBlt DeleteObject CreateDIBSection

shlwapi

SHCreateMemStream

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

shell32

DragQueryFileW SHCreateItemFromParsingName Shell_NotifyIconGetRect ShellExecuteExW SHAppBarMessage ILCreateFromPathW ILFree Shell_NotifyIconW ExtractIconExW SHGetKnownFolderPath ShellExecuteW DragFinish SHOpenFolderAndSelectItems SHGetStockIconInfo

oleaut32

SysFreeString VariantClear SysAllocStringLen SysStringLen GetErrorInfo SetErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW

ws2_32

recv setsockopt connect freeaddrinfo WSACleanup bind WSASocketW WSAStartup shutdown select getaddrinfo ioctlsocket WSASend WSAGetLastError getsockname getpeername closesocket WSAIoctl getsockopt send

crypt32

CertCloseStore CertAddEncodedCertificateToStore CertOpenStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFreeCertificateContext CertSetCertificateContextProperty

bcrypt

BCryptGenRandom

powrprof

PowerReadDCDefaultIndex PowerReadACDefaultIndex PowerReadACValue PowerWriteDCValueIndex CallNtPowerInformation PowerGetActiveScheme PowerReadACValueIndex PowerWriteACValueIndex PowerSetActiveScheme PowerReadDCValueIndex

pdh

PdhOpenQueryW PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryA PdhGetFormattedCounterArrayW PdhCloseQuery

iphlpapi

ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid IcmpCloseHandle IcmpSendEcho IcmpCreateFile GetBestInterfaceEx ConvertInterfaceAliasToLuid

api-ms-win-crt-math-l1-1-0

pow log exp roundf trunc floor round ceil __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncmp strcspn wcslen strncmp strspn strcmp _wcsicmp wcscmp strlen

api-ms-win-crt-heap-l1-1-0

_callnewh free realloc malloc _msize _set_new_mode calloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _c_exit _initialize_onexit_table _get_initial_narrow_environment abort _initterm _initterm_e terminate _cexit _crt_atexit exit _set_app_type _register_onexit_function _exit __p___argv __p___argc _seh_filter_exe _endthreadex _beginthreadex _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_c93eabd034b5d932ccefd4dd207b6252_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

advapi32

ntdll

user32

dwmapi

api-ms-win-core-synch-l1-2-0

propsys

combase

ole32

gdi32

shlwapi

comctl32

shell32

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

imm32

ws2_32

crypt32

bcrypt

powrprof

pdh

iphlpapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic