2026-10-22_55ab1007a519cf374e378c4e4514aaa5_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_55ab1007a519cf374e378c4e4514aaa5_akira_glassworm_rusty-stealer
Size 2.7MB
Sample261024-p35zzsfa28
SHA256 0ffe5a7b2854f00b97ddd9b9222f82a0843ba3f1da0b09e0e1fe3905a19d2276
MD5 55ab1007a519cf374e378c4e4514aaa5
SHA1 aae707948e2d83b8d9ecf1449081b819c2edd330
SHA512 ea923696f96287147b1b1b318140cf02f0317d7936d264437c08b923a09727d4844ed5133f3024ae72dee50efe3ba156b82360725f3a66ec5597ed9741d58efb
SSDEEP 49152:lsEizt7LUh4SCJEaTssIVVfp/xSfno5e6mE726Dr1WIU6iYMtrk:npQM7ZXk6J7261x+Ykrk
TLSH
T167D58C03AA9944ECD09AC474C64B8B67DB7270CB1631E6EF11E48A593F2BEB11F2D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_55ab1007a519cf374e378c4e4514aaa5_akira_glassworm_rusty-stealer

.exe 2.7MB

2026-10-22_55ab1007a519cf374e378c4e4514aaa5_akira_glassworm_rusty-stealer

IMPHASH e719ac225b438622aa4db4b5acef79fd
SHA256 0ffe5a7b2854f00b97ddd9b9222f82a0843ba3f1da0b09e0e1fe3905a19d2276
MD5 55ab1007a519cf374e378c4e4514aaa5
SHA1 aae707948e2d83b8d9ecf1449081b819c2edd330
SHA512 ea923696f96287147b1b1b318140cf02f0317d7936d264437c08b923a09727d4844ed5133f3024ae72dee50efe3ba156b82360725f3a66ec5597ed9741d58efb
SSDEEP 49152:lsEizt7LUh4SCJEaTssIVVfp/xSfno5e6mE726Dr1WIU6iYMtrk:npQM7ZXk6J7261x+Ykrk
TLSH
T167D58C03AA9944ECD09AC474C64B8B67DB7270CB1631E6EF11E48A593F2BEB11F2D315
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bc:38:8d:0d:5a:14:11:e1:c8:6d:e4:91:70:03:b3:92:21:40:f4:bb:d7:d5:87:1d:06:b5:06:8e:df:76:44:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

Chains

Oct 14, 2026

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=HR Korea,O=HR Korea,L=Gangseo-gu,ST=Seoul,C=KR

Serial Number

08:5b:49:4d:0d:cb:6e:5c:0c:48:33:00

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 10, 2026 - Sep 11, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1913944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

uninstall.pdb

kernel32

SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread HeapAlloc GetCommandLineW CreateWaitableTimerExW SetWaitableTimer Sleep WriteConsoleW MultiByteToWideChar UnhandledExceptionFilter WaitForSingleObject SetUnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode DeleteFileW SetFileTime GetStdHandle RtlVirtualUnwind WideCharToMultiByte ReleaseMutex FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact LoadLibraryW GetSystemInfo CreateFileW CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CreateMutexA lstrlenW GetProcAddress GetFullPathNameW LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW SetLastError GetCurrentThreadId TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot HeapReAlloc HeapFree GetModuleHandleA GetProcessHeap GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetEnvironmentVariableW SetHandleInformation ReadFileEx SleepEx QueryPerformanceCounter FormatMessageW IsProcessorFeaturePresent GetLastError GetCurrentProcessId CopyFileExW InitializeSListHead CloseHandle FindClose GetModuleHandleW QueryPerformanceFrequency DeleteFileA WriteFileEx IsDebuggerPresent FindNextFileW GetTimeZoneInformationForYear

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

user32

MessageBoxW

shell32

ShellExecuteW

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

ws2_32

getpeername getaddrinfo send freeaddrinfo WSARecv recv connect ioctlsocket closesocket WSASocketW WSACleanup WSAStartup WSAGetLastError getsockname select getsockopt setsockopt WSADuplicateSocketW WSASend

vcruntime140

__current_exception __current_exception_context strchr _CxxThrowException memmove __CxxFrameHandler3 memcpy memchr strrchr memcmp memset __C_specific_handler

api-ms-win-crt-string-l1-1-0

strncmp strcmp strlen strcspn strspn

api-ms-win-crt-heap-l1-1-0

malloc free _msize realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

fabs log __setusermatherr _dclass

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _endthreadex _configure_narrow_argv _exit __p___argc __p___argv _cexit _beginthreadex _register_thread_local_exe_atexit_callback _initialize_narrow_environment _get_initial_narrow_environment _initialize_onexit_table _initterm_e _register_onexit_function _crt_atexit terminate _initterm _c_exit exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_55ab1007a519cf374e378c4e4514aaa5_akira_glassworm_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

user32

shell32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic