needle_stealer | 2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk

Resubmissions

27/10/2026, 09:10

261027-k49mcasyct10

18/08/2026, 02:32

260818-c1qq3avand8

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk
Size 3.8MB
Sample261027-k49mcasyct
SHA256 636772caab9fcb9ba4c4e839fb169768462d992a07ff32ad7cf2055170f829dc
MD5 1863621788b2d33bd5b4a87e62aab997
SHA1 3c2c52b1431ecf41cfdfca236134dc057bd999ab
SHA512 dc8e26155801f7a7438aa9fbb4ce7ebc12c20609c4e4598ad953a1a46228e39f3234ba58f3c707161d105af198ba7262f0962145279a5b1d8311018ad833e08c
SSDEEP 49152:V4zjD8G4Q7B4FGgLRqZ1lMYgInYo2VKzSVvwGtulnWjiRnSJgLw15UlO4TEEFYPD:/W3lQ6rSuA2SJ+w1MTWPN+Y
TLSH
T11D068D03F69580F9C05DC079874B9632FA32B8890635B2EF6BD45B213E66F906F1E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

777 stealer needle_stealer

Malware Config

Extracted

Family

needle_stealer

Botnet

http://87.120.104.147:8080

Attributes

agent_enabled
true
api_key
2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6
auto_install
true
debug_log
false
pin_extension
false
proxy_enabled
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer with variants written in Golang or Rust.
stealer needle_stealer

Detects NeedleStealer Rust variant 1 IoCs

resource	yara_rule
sample	family_needlestealer_rust

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk

File Explorer

2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk

.exe 3.8MB

2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk

IMPHASH 160c101dd73adb2f729e5b922904fc20
SHA256 636772caab9fcb9ba4c4e839fb169768462d992a07ff32ad7cf2055170f829dc
MD5 1863621788b2d33bd5b4a87e62aab997
SHA1 3c2c52b1431ecf41cfdfca236134dc057bd999ab
SHA512 dc8e26155801f7a7438aa9fbb4ce7ebc12c20609c4e4598ad953a1a46228e39f3234ba58f3c707161d105af198ba7262f0962145279a5b1d8311018ad833e08c
SSDEEP 49152:V4zjD8G4Q7B4FGgLRqZ1lMYgInYo2VKzSVvwGtulnWjiRnSJgLw15UlO4TEEFYPD:/W3lQ6rSuA2SJ+w1MTWPN+Y
TLSH
T11D068D03F69580F9C05DC079874B9632FA32B8890635B2EF6BD45B213E66F906F1E719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects NeedleStealer Rust variant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2711136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CloseHandle CompareStringOrdinal CompareStringW CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateProcessW CreateRemoteThread CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileExA FindFirstFileExW FindFirstVolumeW FindNextFileA FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetTickCount GetTimeZoneInformation GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetPerformanceInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableA SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx WriteProcessMemory lstrlenW

advapi32

ConvertSidToStringSidW CopySid GetLengthSid GetTokenInformation GetUserNameW IsValidSid LookupAccountNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity CryptUnprotectData

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

oleaut32

GetErrorInfo SysAllocStringByteLen SysFreeString SysStringByteLen SysStringLen

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

powrprof

CallNtPowerInformation

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW GetProcessMemoryInfo

user32

GetSystemMetrics

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

273B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk

kernel32

advapi32

bcrypt

crypt32

ntdll

bcryptprimitives

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

powrprof

ole32

shell32

psapi

user32

pdh

generic