2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc
Size 46.1MB
Sample261023-vx83cacy61
SHA256 6a45c4a32fdffc339ecf38a7c35dd7d2efc5ba23f99fe39aeada60754a011887
MD5 db6fe26746512f34cf836ee3c9e3c5b0
SHA1 ffc0c8a1ac6041038970956f81acb8f1d3a6ed76
SHA512 fc26fc1fc1b276ddecb2e75553ba2c26628d47f7da9b00c0f5984546f5cc93ef6e8b32cec8c46b030eeae55afc1c81836fe71703ae53cf714797a5bd91ea5c16
SSDEEP 393216:EaZbVS2F6BAhZg9ax92aByKKAM9du9hI:fZxS2PE9ax92M/j8
TLSH
T1DCB7E6166679A0DAC1BBC0B8C1839F217A2174E947396BF344C196BA2F34EF86D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc

File Explorer

2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc

.exe 46.1MB

2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc

IMPHASH 9137203e76cf42c110c599dec3dad6b6
SHA256 6a45c4a32fdffc339ecf38a7c35dd7d2efc5ba23f99fe39aeada60754a011887
MD5 db6fe26746512f34cf836ee3c9e3c5b0
SHA1 ffc0c8a1ac6041038970956f81acb8f1d3a6ed76
SHA512 fc26fc1fc1b276ddecb2e75553ba2c26628d47f7da9b00c0f5984546f5cc93ef6e8b32cec8c46b030eeae55afc1c81836fe71703ae53cf714797a5bd91ea5c16
SSDEEP 393216:EaZbVS2F6BAhZg9ax92aByKKAM9du9hI:fZxS2PE9ax92M/j8
TLSH
T1DCB7E6166679A0DAC1BBC0B8C1839F217A2174E947396BF344C196BA2F34EF86D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33756076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

edulab.pdb

kernel32

FlushFileBuffers SetLastError GetCurrentThreadId GetProcessId GetExitCodeProcess WaitForSingleObject DuplicateHandle GetCurrentProcess TerminateProcess DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetSystemTime GetUserDefaultUILanguage LCIDToLocaleName GetModuleHandleA Sleep GetFileInformationByHandleEx GetSystemTimeAsFileTime GetFullPathNameW SystemTimeToFileTime GetModuleFileNameW SetThreadErrorMode LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleExW WideCharToMultiByte IsProcessorFeaturePresent LoadLibraryExA GetLastError FindNextFileW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW FormatMessageW SetErrorMode LoadLibraryW GetFileType SetEnvironmentVariableW DeviceIoControl GetTickCount GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW CopyFileExW RemoveDirectoryW GetCommandLineW GetCurrentDirectoryW GetCurrentProcessId WakeConditionVariable GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetHandleInformation SetFilePointerEx SetFileCompletionNotificationModes CreateDirectoryW GetEnvironmentStringsW GetWindowsDirectoryW GetSystemDirectoryW CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateEventW CreateThread QueryPerformanceFrequency SetFileTime SetFileInformationByHandle MoveFileExW SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SleepConditionVariableCS DeleteCriticalSection TryEnterCriticalSection IsDebuggerPresent GetFileSize LeaveCriticalSection MapViewOfFile LocalFree EnterCriticalSection InitializeCriticalSection QueryPerformanceCounter GetStdHandle GetConsoleMode CreateProcessW CreateFileW ReadFile WriteFile GetNamedPipeInfo CreatePipe ExpandEnvironmentStringsW UnhandledExceptionFilter UnlockFile HeapDestroy GetFileInformationByHandle GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort CreateFileMappingW LockFileEx CreateFileA CreateMutexW UnlockFileEx CancelIoEx GetOverlappedResult SetUnhandledExceptionFilter HeapCompact GetSystemInfo HeapReAlloc SetNamedPipeHandleState DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException GetModuleHandleW InitializeConditionVariable HeapFree HeapAlloc FormatMessageA GetProcessHeap CloseHandle InitializeSListHead lstrlenW

advapi32

EventSetInformation EventWriteTransfer SystemFunction036 RegQueryValueExW RegCreateKeyExW EventUnregister EventRegister RegCreateKeyTransactedW RegOpenKeyTransactedW RegCloseKey RegEnumValueW RegOpenKeyExW RegGetValueW

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

ole32

CoTaskMemFree CoTaskMemAlloc OleInitialize RegisterDragDrop CoUninitialize CoCreateFreeThreadedMarshaler CoInitialize RevokeDragDrop CoCreateInstance CoInitializeEx

shell32

SHGetKnownFolderPath SHAppBarMessage SHOpenFolderAndSelectItems DragQueryFileW DragFinish ILCreateFromPathW ILFree SHCreateItemFromParsingName ShellExecuteW ShellExecuteExW

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError RtlGetVersion NtReadFile NtCreateNamedPipeFile NtCreateFile

user32

VkKeyScanW DrawIconEx DrawTextW GetWindowDC OffsetRect ValidateRect RedrawWindow GetMenuBarInfo DestroyMenu GetUpdateRect PostQuitMessage SetMenu CreateAcceleratorTableW DestroyAcceleratorTable RemoveMenu InsertMenuW AppendMenuW CheckMenuItem SetMenuItemInfoW DrawMenuBar TrackPopupMenu CreatePopupMenu TranslateAcceleratorW GetMenuItemInfoW RegisterRawInputDevices GetRawInputData EnumDisplayMonitors PostThreadMessageW MonitorFromPoint TranslateMessage ChangeDisplaySettingsExW RegisterClassExW EnumChildWindows DispatchMessageW SendInput GetKeyboardLayout MapVirtualKeyExW DispatchMessageA GetAsyncKeyState ReleaseCapture ToUnicodeEx GetKeyState SetCapture DestroyIcon GetMenu MsgWaitForMultipleObjectsEx SetWindowDisplayAffinity SystemParametersInfoA GetWindowTextLengthW SetForegroundWindow SetWindowPlacement IsWindowVisible SetWindowLongW GetWindowTextW EnableMenuItem GetSystemMenu GetClipCursor ShowCursor CreateIcon ClipCursor SetPropW CreateWindowExW SetWindowTextW SetFocus SetParent GetWindow ShowWindow RegisterWindowMessageA MapWindowPoints AdjustWindowRect DestroyWindow ReleaseDC GetParent GetWindowPlacement SetWindowLongPtrW IsProcessDPIAware GetWindowLongPtrW GetWindowRect FindWindowExW IsWindowEnabled EnableWindow GetDC SetWindowRgn CloseTouchInputHandle RegisterTouchWindow GetTouchInputInfo FillRect MonitorFromWindow MonitorFromRect GetMonitorInfoW ScreenToClient InvalidateRect ClientToScreen InvalidateRgn UpdateWindow TrackMouseEvent GetActiveWindow SetCursor IsWindow IsIconic SystemParametersInfoW GetForegroundWindow AdjustWindowRectEx GetSystemMetrics GetWindowLongW DefWindowProcW GetClientRect FlashWindowEx SetCursorPos SendMessageW GetCursorPos LoadCursorW SetWindowPos PostMessageW PeekMessageW GetMessageW GetMessageA MapVirtualKeyW CreateMenu GetKeyboardState

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect DefSubclassProc

shlwapi

SHCreateMemStream

gdi32

BitBlt CreateSolidBrush SetBkMode CreateRectRgn DeleteObject CombineRgn GetDeviceCaps DeleteDC CreateDIBSection SelectObject CreateCompatibleDC SetTextColor

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

ws2_32

getaddrinfo WSACleanup getsockopt WSAGetLastError ioctlsocket closesocket recv send WSAStartup bind getsockname listen freeaddrinfo connect accept WSASocketW WSADuplicateSocketW shutdown WSAIoctl WSASend getpeername setsockopt

secur32

ApplyControlToken InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext DecryptMessage

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertDuplicateStore CertCloseStore CertAddCertificateContextToStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain

bcrypt

BCryptGenRandom

vcruntime140

strrchr __C_specific_handler __std_exception_destroy strchr memchr _CxxThrowException __std_exception_copy memset _purecall __current_exception_context __current_exception memmove memcmp memcpy __CxxFrameHandler3 wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf sinf cosf powf _dclass fabs trunc log2 roundf pow round truncf floor log

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _configure_narrow_argv _invoke_watson _wassert _endthreadex _beginthreadex _initterm terminate _initterm_e exit _set_app_type _exit __p___argc __p___argv _seh_filter_exe _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-heap-l1-1-0

_msize realloc free malloc calloc _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fflush __stdio_common_vsprintf_s __stdio_common_vsnprintf_s __p__commode __stdio_common_vfprintf _set_fmode

api-ms-win-crt-string-l1-1-0

strcspn strcat_s strlen strncmp strspn wcslen wcscmp _wcsicmp strcmp

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong qsort _rotl64 _byteswap_uint64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxASIS OnigSyntaxEmacs OnigSyntaxGnuRegex OnigSyntaxGrep OnigSyntaxJava OnigSyntaxOniguruma OnigSyntaxPerl OnigSyntaxPerl_NG OnigSyntaxPosixBasic OnigSyntaxPosixExtended OnigSyntaxPython OnigSyntaxRuby onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_copy_syntax onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_syntax_behavior onig_get_syntax_op onig_get_syntax_op2 onig_get_syntax_options onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_default_syntax onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_meta_char onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_syntax_behavior onig_set_syntax_op onig_set_syntax_op2 onig_set_syntax_options onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null

Name

.text

Size

32.2MB

Virtual Size

32.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

178KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_db6fe26746512f34cf836ee3c9e3c5b0_akira_glassworm_rusty-stealer_stealc

kernel32

advapi32

oleaut32

ole32

shell32

bcryptprimitives

ntdll

user32

api-ms-win-core-synch-l1-2-0

comctl32

shlwapi

gdi32

dwmapi

ws2_32

secur32

crypt32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic