2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer
Size 9.9MB
Sample261024-ms1amstwhw
SHA256 e4d2fdb0ed2e7c0d6c9052e17f0c904ecb548624878c19c157abc34de3c53ad8
MD5 64e8c405e255bd6b8a57ecc7ce8e17e5
SHA1 60e3cf1e42474b11a6b79213eb19f7bf4c00e991
SHA512 2e40a51d5286298c76aec84e2c5711cb8bc858da7ae8ef75c2704b946bb13ae8bbd5aff4aa772563bc02af675f37039897eb4e25159e4cfe31200c5fb32c6f11
SSDEEP 98304:MYHJyiaGrsr4Og6wU1tONlVJwGQM6Eu9:9HoiBs
TLSH
T1DCA6C52A667D90EDD17BC0B882838F61692170DA0B396FF344D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer

File Explorer

2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer

.exe 9.9MB

2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer

IMPHASH 7a2428639725e034b5b26b319b245341
SHA256 e4d2fdb0ed2e7c0d6c9052e17f0c904ecb548624878c19c157abc34de3c53ad8
MD5 64e8c405e255bd6b8a57ecc7ce8e17e5
SHA1 60e3cf1e42474b11a6b79213eb19f7bf4c00e991
SHA512 2e40a51d5286298c76aec84e2c5711cb8bc858da7ae8ef75c2704b946bb13ae8bbd5aff4aa772563bc02af675f37039897eb4e25159e4cfe31200c5fb32c6f11
SSDEEP 98304:MYHJyiaGrsr4Og6wU1tONlVJwGQM6Eu9:9HoiBs
TLSH
T1DCA6C52A667D90EDD17BC0B882838F61692170DA0B396FF344D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7674424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-5db9e2a8c661c105.pdb

bcryptprimitives

ProcessPrng

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

HeapFree GetProcessHeap SetFileTime CreateFileW SetFileInformationByHandle CreateThread CreateEventW GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetModuleHandleA GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetLastError CancelIo GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetEnvironmentStringsW HeapReAlloc GetStdHandle SetUnhandledExceptionFilter CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW CopyFileExW FindFirstFileExW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeviceIoControl DeleteFileW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW SetCurrentDirectoryW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetModuleHandleW FormatMessageW GetFileInformationByHandle GetNativeSystemInfo LoadLibraryA GetProcAddress GetSystemTimeAsFileTime WaitForSingleObject WaitForMultipleObjects IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW FindClose CloseHandle lstrlenW GetConsoleMode UnhandledExceptionFilter QueryPerformanceCounter

ole32

CoInitializeEx CoCreateInstance CoInitialize

oleaut32

SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

RegOpenKeyExW RegQueryValueExW RegOpenKeyExA RegEnumKeyExW RegCloseKey

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

memmove __CxxFrameHandler3 memcpy memcmp memset wcschr _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

_wcsdup wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_set_fmode fclose __stdio_common_vswscanf _wfopen_s __p__commode _get_osfhandle fgetws _fileno

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _cexit _configure_narrow_argv _set_app_type _seh_filter_exe _crt_atexit _initterm_e _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function exit __p___argv _exit __p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_64e8c405e255bd6b8a57ecc7ce8e17e5_akira_rusty-stealer

bcryptprimitives

shell32

combase

kernel32

ole32

oleaut32

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic