2026-10-25_91f693ff0cf283b04d96233efeade40e_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_91f693ff0cf283b04d96233efeade40e_akira_rusty-stealer
Size 2.5MB
Sample261026-yl7xpags6w
SHA256 198189caf8921a50452408da85d8ee81b7f25c2bb1809afb7354e7df097cb192
MD5 91f693ff0cf283b04d96233efeade40e
SHA1 222cf03d39ddad03302fc62fdc9a14fc65579dce
SHA512 b4146be309ab3afcd0f6464c88a28054a49ee56422196cf2914c7c08f28cd5127505573950969d0e2fb6863aee1ae21b1f1b6b9ca24404bd2a3eb14f4fc93a8e
SSDEEP 49152:dix8wNc7GQ+v3ihNQjwzPA+JK8UTLHHHpFXrNQiXfQr:USr7CihNHzETJF5TXs
TLSH
T13FC54A03F5E180E8C05DC4B5935AA233F736B88D493476AB2BD46B252F79F50AB2D709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-25_91f693ff0cf283b04d96233efeade40e_akira_rusty-stealer

.exe 2.5MB

2026-10-25_91f693ff0cf283b04d96233efeade40e_akira_rusty-stealer

IMPHASH 5e7f55b45eec0494747960c06d3a8d71
SHA256 198189caf8921a50452408da85d8ee81b7f25c2bb1809afb7354e7df097cb192
MD5 91f693ff0cf283b04d96233efeade40e
SHA1 222cf03d39ddad03302fc62fdc9a14fc65579dce
SHA512 b4146be309ab3afcd0f6464c88a28054a49ee56422196cf2914c7c08f28cd5127505573950969d0e2fb6863aee1ae21b1f1b6b9ca24404bd2a3eb14f4fc93a8e
SSDEEP 49152:dix8wNc7GQ+v3ihNQjwzPA+JK8UTLHHHpFXrNQiXfQr:USr7CihNHzETJF5TXs
TLSH
T13FC54A03F5E180E8C05DC4B5935AA233F736B88D493476AB2BD46B252F79F50AB2D709
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a9:a5:fd:38:f8:3d:b3:63:60:cf:f3:d4:b2:eb:f8:d1:11:fd:45:44:36:8f:d8:1b:30:02:ce:e0:19:3f:a4:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

Chains

Oct 17, 2026

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Weiyi Shi,O=Weiyi Shi,L=Ann Arbor,ST=mi,C=US

Serial Number

33:00:08:65:28:f7:be:c9:83:a7:97:c5:7f:00:00:00:08:65:28

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2026 - Oct 18, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5e:2e:11:6e:1c:76:9c:ef:05:00:00:00:00:00:5e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

1986768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

glance.pdb

ntdll

RtlNtStatusToDosError NtQuerySystemInformationEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation

kernel32

CloseHandle GetFinalPathNameByHandleW SetThreadGroupAffinity FreeLibrary CancelSynchronousIo GetModuleHandleW SwitchToThread GetCurrentProcess RemoveDirectoryW WaitForSingleObject GetExitCodeProcess GetSystemCpuSetInformation CreateToolhelp32Snapshot Process32FirstW QueryFullProcessImageNameW Process32NextW CopyFileExW OpenMutexW GetProcAddress GetSystemFirmwareTable CreateFileW GetNamedPipeServerProcessId GetSystemInfo QueryPerformanceFrequency GetActiveProcessorGroupCount SetFileInformationByHandle GetSystemTimePreciseAsFileTime GetLogicalDrives GetTickCount64 GetUserDefaultUILanguage QueryUnbiasedInterruptTime GetSystemPowerStatus GetCurrentProcessId OpenProcess HeapAlloc QueryPerformanceCounter GetLastError DeviceIoControl HeapReAlloc HeapFree LoadLibraryExW GetProcessHeap FindClose IsProcessorFeaturePresent CreateFileMappingW MapViewOfFile WaitNamedPipeW ProcessIdToSessionId SetEvent GetDriveTypeW FormatMessageW OpenEventW GetTickCount GetSystemTimeAsFileTime GetActiveProcessorCount ReleaseMutex GetSystemDirectoryW CompareStringOrdinal GetCurrentThread TerminateProcess ReadFile SetHandleInformation CreateWaitableTimerExW LocalFree GetLogicalProcessorInformationEx GetLocalTime CreateDirectoryW CreateMutexW SetLastError LoadLibraryExA FindNextFileW GetFileAttributesW GetWindowsDirectoryW CreatePipe SetWaitableTimer DeleteProcThreadAttributeList CreateProcessW UpdateProcThreadAttribute InitializeProcThreadAttributeList CancelIo ExitProcess SetThreadStackGuarantee GetOverlappedResult Sleep GetCurrentThreadId ReadFileEx WaitForMultipleObjects SleepEx WriteFileEx CreateThread DeleteFileW GetModuleFileNameW GetModuleHandleA DuplicateHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandleEx CreateEventW GetFileInformationByHandle SetFileTime FindFirstFileExW GetDiskFreeSpaceExW GetFullPathNameW MultiByteToWideChar WaitForSingleObjectEx WideCharToMultiByte GlobalAlloc LoadLibraryA GlobalLock GlobalUnlock lstrlenW GlobalFree CreateMutexA SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead AddVectoredExceptionHandler GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

oleaut32

SetErrorInfo SafeArrayGetUBound SysAllocStringLen GetErrorInfo SafeArrayGetLBound SysFreeString SafeArrayGetElement SysStringLen VariantClear

user32

KillTimer SetTimer SetLayeredWindowAttributes ReleaseDC GetAsyncKeyState GetDpiForSystem RegisterClassExW ReleaseCapture SendInput TrackMouseEvent SetCursor GetKeyState SetWindowTextW GetClientRect MonitorFromPoint OpenClipboard SetCapture GetCursorInfo EmptyClipboard EnumDisplayMonitors CloseClipboard GetWindowLongPtrW ScreenToClient EnumDisplayDevicesW DestroyWindow IsWindowVisible IsIconic GetWindowRect GetMonitorInfoW GetWindowThreadProcessId SetClipboardData SetWindowLongPtrW GetDpiForWindow GetRawInputDeviceInfoW GetRawInputData GetCaretBlinkTime EnableWindow RegisterRawInputDevices WaitMessage MsgWaitForMultipleObjects PeekMessageW RegisterClassW GetWindow LoadCursorW RegisterWindowMessageW PrintWindow CreateWindowExW GetSysColor SetFocus ChangeWindowMessageFilterEx GetMessageW IsWindow SetWindowPos SystemParametersInfoW DispatchMessageW GetDC FindWindowW MessageBoxW EnumDisplaySettingsW IsZoomed MonitorFromWindow EnumWindows FindWindowExW SetForegroundWindow ShowWindow GetWindowTextW GetCursorPos GetShellWindow GetKeyNameTextW GetForegroundWindow RemoveClipboardFormatListener TranslateMessage InvalidateRect ValidateRect MapVirtualKeyW AddClipboardFormatListener RegisterHotKey UnregisterHotKey LoadImageW IsClipboardFormatAvailable GetSystemMetrics DefWindowProcW PostThreadMessageW PostQuitMessage PostMessageW AllowSetForegroundWindow GetClipboardData

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

advapi32

SaferCreateLevel SaferComputeTokenFromLevel SaferCloseLevel ConvertStringSidToSidW GetLengthSid SetTokenInformation CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ProcessTrace EnableTraceEx2 ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegOpenKeyExW RegEnumValueW RegCloseKey RegDeleteValueW MapGenericMask GetAce GetNamedSecurityInfoW RegCreateKeyExW RegSetValueExW RegNotifyChangeKeyValue RegGetValueW SetNamedSecurityInfoW ControlTraceW OpenTraceW CloseTrace RegQueryInfoKeyW GetSecurityDescriptorDacl StartTraceW

dwmapi

DwmRegisterThumbnail DwmUpdateThumbnailProperties DwmExtendFrameIntoClientArea DwmGetWindowAttribute DwmUnregisterThumbnail DwmSetWindowAttribute DwmGetCompositionTimingInfo

propsys

VariantToUInt32 PropVariantToBSTR VariantToInt32 VariantToPropVariant VariantToInt64

pdh

PdhGetFormattedCounterArrayW PdhGetFormattedCounterValue PdhOpenQueryW PdhAddEnglishCounterW PdhCollectQueryData PdhCloseQuery

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

dxgi

CreateDXGIFactory1

gdi32

D3DKMTOpenAdapterFromLuid BitBlt CreateDIBSection DeleteDC D3DKMTCloseAdapter CreateCompatibleDC DeleteObject GdiFlush SelectObject D3DKMTQueryAdapterInfo

ole32

GetHGlobalFromStream PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoSetProxyBlanket

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstanceIdW SetupDiSetClassInstallParamsW SetupDiGetDeviceInterfaceDetailW SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList

bcryptprimitives

ProcessPrng

iphlpapi

GetBestInterface FreeMibTable GetIfTable2 GetAdaptersAddresses

wlanapi

WlanQueryInterface WlanCloseHandle WlanFreeMemory WlanOpenHandle

psapi

GetPerformanceInfo

wevtapi

EvtCreateRenderContext EvtClose EvtRender EvtNext EvtQuery

computecore

HcsWaitForOperationResult HcsCloseOperation HcsEnumerateComputeSystems HcsCreateOperation

shell32

ShellExecuteExW SHCreateItemFromParsingName ShellExecuteW DragAcceptFiles DragFinish DragQueryFileW Shell_NotifyIconW SHQueryUserNotificationState SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoIncrementMTAUsage

ws2_32

WSAStartup closesocket WSACleanup getaddrinfo setsockopt connect WSAGetLastError WSASocketW recv freeaddrinfo send

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

crypt32

CertNameToStrW CertGetEnhancedKeyUsage CertGetCertificateContextProperty

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpOpen WinHttpSetOption WinHttpReadData WinHttpSetTimeouts WinHttpConnect WinHttpReceiveResponse WinHttpOpenRequest WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest

tdh

TdhGetProperty TdhGetPropertySize

hid

HidP_MaxUsageListLength HidP_GetUsages HidP_GetUsageValue HidP_GetValueCaps HidP_GetButtonCaps HidP_GetCaps

d3d11

D3D11CreateDevice CreateDirect3D11DeviceFromDXGIDevice

d2d1

D2D1MakeRotateMatrix D2D1CreateFactory

dcomp

DCompositionCreateDevice2

imm32

ImmAssociateContextEx ImmGetContext ImmGetVirtualKey ImmReleaseContext ImmSetCompositionFontW ImmSetCandidateWindow ImmSetCompositionWindow

coremessaging

CreateDispatcherQueueController

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

comdlg32

GetOpenFileNameW

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

dwrite

DWriteCreateFactory

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler memmove memcmp memset memcpy

api-ms-win-crt-math-l1-1-0

log10 _hypotf floor ceil pow powf atan2f roundf round asinf fmodf truncf log10f exp2 floorf cosf __setusermatherr sinf ceilf trunc log

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _get_initial_narrow_environment _initterm_e _initterm _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_91f693ff0cf283b04d96233efeade40e_akira_rusty-stealer

ntdll

kernel32

oleaut32

user32

api-ms-win-shcore-scaling-l1-1-1

advapi32

dwmapi

propsys

pdh

api-ms-win-core-synch-l1-2-0

dxgi

gdi32

ole32

setupapi

bcryptprimitives

iphlpapi

wlanapi

psapi

wevtapi

computecore

shell32

combase

ws2_32

wintrust

crypt32

version

winhttp

tdh

hid

d3d11

d2d1

dcomp

imm32

coremessaging

api-ms-win-core-winrt-l1-1-0

comdlg32

api-ms-win-shcore-stream-winrt-l1-1-0

dwrite

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic