2026-10-22_af3db009f4ab96e8bdf0888e8248011f_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_af3db009f4ab96e8bdf0888e8248011f_akira_glassworm_rusty-stealer
Size 3.3MB
Sample261024-asbk3agy6p
SHA256 29569ee7c77766aa01bf5f3b338d726ccc9da6981d4d107997cfe28105392588
MD5 af3db009f4ab96e8bdf0888e8248011f
SHA1 7bd676deb07d3cbae3a8460b0683b41b93dde7f6
SHA512 0bad40448841491282b8854add76d97d169b82521749267f3d26a730c1e960952d351a179ceffbffa116c676f71e6ebd67dc2e8072b9afbff3f7a22fef93fdf2
SSDEEP 49152:12qtNoQx52bS74Cgse8LKAXiHYhTeh1p2bMABbDhx+rUKWIU6iLpE6:FowvnS27bTBbdxQUKx+LpE6
TLSH
T1F6F58C13BB8948E8D19AC478C64B4B639F7270CB1A31F6AF01E446653F6BAB15F2C315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_af3db009f4ab96e8bdf0888e8248011f_akira_glassworm_rusty-stealer

.exe 3.3MB

2026-10-22_af3db009f4ab96e8bdf0888e8248011f_akira_glassworm_rusty-stealer

IMPHASH b66ae32a2e38250e0614e8bc6c68fc2f
SHA256 29569ee7c77766aa01bf5f3b338d726ccc9da6981d4d107997cfe28105392588
MD5 af3db009f4ab96e8bdf0888e8248011f
SHA1 7bd676deb07d3cbae3a8460b0683b41b93dde7f6
SHA512 0bad40448841491282b8854add76d97d169b82521749267f3d26a730c1e960952d351a179ceffbffa116c676f71e6ebd67dc2e8072b9afbff3f7a22fef93fdf2
SSDEEP 49152:12qtNoQx52bS74Cgse8LKAXiHYhTeh1p2bMABbDhx+rUKWIU6iLpE6:FowvnS27bTBbdxQUKx+LpE6
TLSH
T1F6F58C13BB8948E8D19AC478C64B4B639F7270CB1A31F6AF01E446653F6BAB15F2C315
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

66:fe:3b:2f:b2:db:d6:11:5d:6c:b1:84:c8:89:2f:dd:22:56:0b:f0:f4:da:0b:6d:ee:87:4e:65:f1:69:32:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

Chains

Oct 14, 2026

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

Serial Number

08:5b:49:4d:0d:cb:6e:5c:0c:48:33:00

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 10, 2026 - Sep 11, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2262296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iconman1.pdb

kernel32

RtlVirtualUnwind WideCharToMultiByte ReleaseMutex GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateMutexA SetHandleInformation CreateWaitableTimerExW SetWaitableTimer Sleep lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetStdHandle GetCurrentDirectoryW SetLastError GetCurrentThreadId GetSystemInfo FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx LocalFree GetConsoleMode HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryFullProcessImageNameW GetConsoleOutputCP QueryPerformanceCounter FormatMessageW GetModuleHandleW HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler QueryPerformanceFrequency UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent SetFileInformationByHandle DeleteFileW CopyFileExW InitializeSListHead GetLastError WriteFileEx Process32NextW TerminateProcess OpenProcess Process32FirstW SleepEx ReadFileEx GetEnvironmentVariableW HeapAlloc WriteConsoleW MultiByteToWideChar CreateToolhelp32Snapshot GetCurrentProcessId CloseHandle UnlockFile WaitForSingleObject IsDebuggerPresent CreateThread GetTimeZoneInformationForYear

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegCloseKey SystemFunction036 RegOpenKeyExW RegCreateKeyExW RegSetValueExW

user32

GetWindowTextW GetWindowLongW SetWindowLongW ShowWindow SetLayeredWindowAttributes PostMessageW GetWindowThreadProcessId GetForegroundWindow IsWindow

bcrypt

BCryptGenRandom

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile

ws2_32

ioctlsocket freeaddrinfo WSASocketW WSADuplicateSocketW WSAStartup WSAGetLastError getsockname setsockopt WSASend send getaddrinfo getpeername WSARecv recv connect select WSACleanup getsockopt closesocket

vcruntime140

memmove _CxxThrowException __CxxFrameHandler3 memchr strchr strrchr __C_specific_handler __current_exception __current_exception_context memset memcpy memcmp

api-ms-win-crt-string-l1-1-0

strcmp strspn strlen strcspn strncmp

api-ms-win-crt-heap-l1-1-0

free _msize malloc _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

fabs _dclass __setusermatherr log

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _beginthreadex _endthreadex _initterm_e exit _exit __p___argc _initialize_narrow_environment _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_af3db009f4ab96e8bdf0888e8248011f_akira_glassworm_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

user32

bcrypt

ntdll

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic