2026-10-23_4f32fec7f0886b881816bdeae5b7b80e_akira_glassworm_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_4f32fec7f0886b881816bdeae5b7b80e_akira_glassworm_icedid_rusty-stealer
Size 30.3MB
Sample261023-pm43rabw8y
SHA256 7f287f067eb57b2276d976a0a21fb597801758eaebb779bc76c7dcaabf4e645d
MD5 4f32fec7f0886b881816bdeae5b7b80e
SHA1 732b3f7416107041b8b3c303a74541d289019ce5
SHA512 d9d567db2cc1a8ed1886dba9f8c08b020da12ce6f7d8503c6bc64f2b6080e20ad0dd2baeeec9faa5f0b538d1e3da0767f618534ad3b87b7dc904977ec19ca8fe
SSDEEP 196608:ErtRFeQ2o+G7NaTXT7M9YqQPpA6uXTDdIzM8e1PPM2L:Er9vdMTXnKYqsMPtyi
TLSH
T1AD673B03F69184D4D06AC4B4935AE633EB71BC994A3473FB5BD44B222F2AF906B1C719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-10-23_4f32fec7f0886b881816bdeae5b7b80e_akira_glassworm_icedid_rusty-stealer

.exe 30.3MB

2026-10-23_4f32fec7f0886b881816bdeae5b7b80e_akira_glassworm_icedid_rusty-stealer

IMPHASH 094ad925a71cc446b7c7bf00e3313335
SHA256 7f287f067eb57b2276d976a0a21fb597801758eaebb779bc76c7dcaabf4e645d
MD5 4f32fec7f0886b881816bdeae5b7b80e
SHA1 732b3f7416107041b8b3c303a74541d289019ce5
SHA512 d9d567db2cc1a8ed1886dba9f8c08b020da12ce6f7d8503c6bc64f2b6080e20ad0dd2baeeec9faa5f0b538d1e3da0767f618534ad3b87b7dc904977ec19ca8fe
SSDEEP 196608:ErtRFeQ2o+G7NaTXT7M9YqQPpA6uXTDdIzM8e1PPM2L:Er9vdMTXnKYqsMPtyi
TLSH
T1AD673B03F69184D4D06AC4B4935AE633EB71BC994A3473FB5BD44B222F2AF906B1C719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist

Digest

f2:87:31:9f:a7:ac:46:2b:4f:ac:3a:0a:31:e9:52:7c:e8:0a:91:71:70:f8:43:83:15:ce:ea:dd:d0:1b:cf:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

24679008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agency.pdb

kernel32

GetOverlappedResult CreateIoCompletionPort CancelIoEx WaitForSingleObjectEx CreateSemaphoreW CancelIo Sleep CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetQueuedCompletionStatus Thread32First OpenThread Thread32Next DuplicateHandle GetCurrentThreadId CreateMutexA ReleaseMutex SleepEx CreateThread CreateEventW ExitProcess CreateWaitableTimerExW SetWaitableTimer GetSystemTimes GetProcessIoCounters CreateJobObjectW UpdateProcThreadAttribute UnregisterWaitEx RegisterWaitForSingleObject GetOEMCP GetACP FreeLibrary CreateMutexW ResumeThread LocalFree IsValidCodePage GetQueuedCompletionStatusEx GetProcAddress LoadLibraryExA GetCPInfo GetProcessHeap HeapFree DeviceIoControl UnlockFile FindClose GetSystemTimePreciseAsFileTime SetLastError ClosePseudoConsole TerminateProcess HeapReAlloc SetInformationJobObject CreateProcessW InitializeProcThreadAttributeList GetProcessId GetNumberOfConsoleInputEvents GenerateConsoleCtrlEvent CreatePseudoConsole SetFileTime GetStdHandle GetLogicalProcessorInformationEx GetSystemInfo SetFileInformationByHandle LCMapStringW CompareStringW GlobalFree WaitForMultipleObjects IsProcessInJob GetConsoleMode SetConsoleMode CreateConsoleScreenBuffer GetExitCodeProcess WaitForSingleObject TerminateJobObject GetConsoleWindow SetHandleInformation CreateFileW CreateDirectoryW GetCurrentProcessId InitializeCriticalSectionEx GetTimeZoneInformation GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute ReleaseSemaphore GetLastError SwitchToThread GetProcessTimes GetFileInformationByHandleEx FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorPosition ReadConsoleInputW SetConsoleCursorInfo GetCommandLineA InitializeCriticalSectionAndSpinCount SetConsoleActiveScreenBuffer GetBinaryTypeW MoveFileExW IsWow64Process2 GetFullPathNameW SetFileCompletionNotificationModes QueryInformationJobObject QueryFullProcessImageNameW Process32FirstW CreateToolhelp32Snapshot Process32NextW GetCurrentThread SetThreadStackGuarantee GetModuleHandleA GetNativeSystemInfo IsWow64Process CloseHandle GetCurrentProcess DeleteProcThreadAttributeList IsDebuggerPresent GetModuleHandleW PostQueuedCompletionStatus LoadLibraryA GetConsoleOutputCP WriteConsoleW HeapAlloc FindFirstFileExW ReadConsoleW FlushFileBuffers GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW SetFileAttributesW CopyFileExW CreateSymbolicLinkW CreateHardLinkW SetFilePointerEx FindNextFileW VirtualQueryEx GetDiskFreeSpaceExW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW GetDriveTypeW GetVolumeInformationW GlobalMemoryStatusEx SetConsoleCtrlHandler SystemTimeToFileTime GlobalAlloc GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime GetFileSize HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeSListHead AssignProcessToJobObject GetConsoleProcessList SetUnhandledExceptionFilter OpenProcess FormatMessageW UnhandledExceptionFilter SetStdHandle VirtualProtect GetModuleHandleExW FreeLibraryAndExitThread LoadLibraryExW EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW LockFileEx ReadFile IsProcessorFeaturePresent DeleteCriticalSection WriteFile SetCurrentDirectoryW TryEnterCriticalSection LeaveCriticalSection CreatePipe GetTimeZoneInformationForYear GetStringTypeW GetFileInformationByHandle GetComputerNameExW AddVectoredExceptionHandler PeekNamedPipe EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA K32GetModuleBaseNameW UnlockFileEx OutputDebugStringW FormatMessageA K32GetPerformanceInfo ReadProcessMemory GetCommandLineW ReadDirectoryChangesW FreeEnvironmentStringsW GetEnvironmentStringsW lstrlenW SetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency CompareStringOrdinal CreateNamedPipeW GetNamedPipeClientProcessId GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW WriteFileEx ReadFileEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

advapi32

GetSecurityInfo ConvertSidToStringSidW SetSecurityInfo RegEnumKeyExW SystemFunction036 RegDeleteValueW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegOpenKeyExW RegDeleteTreeW RegSetValueExW RegQueryValueExW CopySid GetLengthSid AdjustTokenPrivileges LookupPrivilegeValueW GetAce IsValidAcl GetTokenInformation OpenProcessToken IsValidSid GetSecurityDescriptorDacl GetSecurityDescriptorOwner

ntdll

RtlPcToFileHeader RtlUnwindEx NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtQueryInformationFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile RtlGetVersion NtQueryInformationProcess NtQuerySystemInformation RtlNtStatusToDosError

oleaut32

SysFreeString SysStringLen GetErrorInfo

combase

CoTaskMemFree

secur32

DeleteSecurityContext FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW DecryptMessage ApplyControlToken EncryptMessage FreeCredentialsHandle AcquireCredentialsHandleA

crypt32

CertDuplicateCertificateChain CryptMsgClose CertNameToStrW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertGetCertificateContextProperty CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CertOpenStore CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

user32

ToUnicodeEx ShowWindow GetForegroundWindow GetWindowThreadProcessId GetSystemMetrics GetKeyboardLayout

bcrypt

BCryptGenRandom

ws2_32

WSAStartup WSAIoctl select WSACleanup WSASocketW send accept getaddrinfo freeaddrinfo bind listen setsockopt getsockopt closesocket recv connect ioctlsocket socket getpeername getsockname WSASend shutdown WSAGetLastError WSADuplicateSocketW

wintrust

WinVerifyTrust

shell32

SHGetKnownFolderPath CommandLineToArgvW

psapi

GetModuleFileNameExW

pdh

PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhCollectQueryData PdhGetFormattedCounterValue PdhEnumObjectsA PdhOpenQueryA

powrprof

CallNtPowerInformation

Name

.text

Size

24.0MB

Virtual Size

24.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

113KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

397KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_4f32fec7f0886b881816bdeae5b7b80e_akira_glassworm_icedid_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

oleaut32

combase

secur32

crypt32

bcryptprimitives

user32

bcrypt

ws2_32

wintrust

shell32

psapi

pdh

powrprof

generic