2026-10-26_6d26c89f15e7ecda71a9f26799b2a848_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_6d26c89f15e7ecda71a9f26799b2a848_akira_glassworm_rusty-stealer
Size 3.2MB
Sample261027-sdphgsey5k
SHA256 7b49edf06c0cbc1500749aabf9936e27979a8a035caf182beffb58a50e5ec818
MD5 6d26c89f15e7ecda71a9f26799b2a848
SHA1 817aadc361476b85171570d0425dc03a4b930e68
SHA512 324b89ad66efa33c2f23a8f24ceba8889ea89a172716e12852f35bded97802e510110818c4deb3d1b5a077c062f335f0887d61d3b682c40f2634adf5fee3ed15
SSDEEP 49152:z6JI8vIt9QZ1nxN25T01njkVTyl46wyHgdKxlQwD616H/xJomRiGr:zlQnrHyIgd3861+/xJ9
TLSH
T199F54B53F65650E8C56EC13883969133FA32748907306AEF2AE44B252F16FD06B3DF69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_6d26c89f15e7ecda71a9f26799b2a848_akira_glassworm_rusty-stealer

.exe 3.2MB

2026-10-26_6d26c89f15e7ecda71a9f26799b2a848_akira_glassworm_rusty-stealer

IMPHASH 32a311c0053cdc80eb4ab4766b7e1ec6
SHA256 7b49edf06c0cbc1500749aabf9936e27979a8a035caf182beffb58a50e5ec818
MD5 6d26c89f15e7ecda71a9f26799b2a848
SHA1 817aadc361476b85171570d0425dc03a4b930e68
SHA512 324b89ad66efa33c2f23a8f24ceba8889ea89a172716e12852f35bded97802e510110818c4deb3d1b5a077c062f335f0887d61d3b682c40f2634adf5fee3ed15
SSDEEP 49152:z6JI8vIt9QZ1nxN25T01njkVTyl46wyHgdKxlQwD616H/xJomRiGr:zlQnrHyIgd3861+/xJ9
TLSH
T199F54B53F65650E8C56EC13883969133FA32748907306AEF2AE44B252F16FD06B3DF69
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

86:f4:77:00:23:0b:72:c9:61:5f:ac:f5:12:b1:43:c0:45:54:09:ac:a6:db:ff:1c:b0:1d:7f:20:e7:f3:68:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Appgate Cybersecurity\, INC.,O=Appgate Cybersecurity\, INC.,L=Coral Gables,ST=Florida,C=US

Chains

Apr 22, 2026

CN=Appgate Cybersecurity\, INC.,O=Appgate Cybersecurity\, INC.,L=Coral Gables,ST=Florida,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Appgate Cybersecurity\, INC.,O=Appgate Cybersecurity\, INC.,L=Coral Gables,ST=Florida,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Appgate Cybersecurity\, INC.,O=Appgate Cybersecurity\, INC.,L=Coral Gables,ST=Florida,C=US

Serial Number

0a:f2:86:0c:a3:05:ac:c1:98:25:54:9e:4c:2d:be:20

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2024 - Feb 22, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2292512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BuildAgent\work\cabf95aa4bca1f9d\src\ipt\src\appgate-driver.pdb

advapi32

RegOpenKeyExA GetTokenInformation RegOpenKeyExW OpenProcessToken IsValidSid GetLengthSid CopySid RegCloseKey RegQueryValueExW RegQueryValueExA LookupAccountSidA RegCreateKeyExA RegDeleteKeyValueA RegCreateKeyA RegEnumKeyA RegDeleteKeyA RegQueryMultipleValuesA RegEnumKeyExA RegEnumValueA RegSetValueExA RegSetValueExW ReportEventA SetEntriesInAclA AllocateAndInitializeSid FreeSid SetSecurityInfo RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceCtrlDispatcherA RegisterEventSourceA GetSecurityInfo

kernel32

WriteFileEx GetNamedPipeClientProcessId GetCurrentProcessId CloseHandle SleepEx GetFullPathNameW WaitForSingleObject GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter Sleep CreateEventW LocalAlloc LoadLibraryExA SetHandleInformation ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CreateThread CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW Process32Next SetThreadStackGuarantee GetCurrentThread DeleteFileA GetSystemTime FindFirstFileExW FindFirstFileA GetSystemInfo SwitchToThread WaitForSingleObjectEx GetExitCodeThread DeleteFileW HeapAlloc ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW GetFileType FormatMessageW WaitForMultipleObjects GetModuleHandleA FindNextFileW GetVersionExW GetProcAddress K32GetModuleFileNameExA CreateToolhelp32Snapshot GlobalMemoryStatusEx K32GetPerformanceInfo GetTickCount64 UnregisterWaitEx RegisterWaitForSingleObject GetWindowsDirectoryA LocalFree Process32First GetSystemDirectoryA SetErrorMode GetConsoleScreenBufferInfo SetConsoleMode SetConsoleTextAttribute SetFileTime SetLastError ReleaseMutex PostQueuedCompletionStatus SetConsoleCtrlHandler CreateMutexA FindNextFileA OpenProcess VirtualQueryEx Process32FirstW Process32NextW WTSGetActiveConsoleSessionId FreeLibrary CreateEventA GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory GetQueuedCompletionStatusEx GetLastError CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile ConnectNamedPipe CancelIoEx GetNamedPipeClientSessionId SystemTimeToFileTime RemoveDirectoryA CreateFileA GetFileAttributesA FindClose GetTimeZoneInformationForYear FormatMessageA InitializeSListHead UnhandledExceptionFilter CancelSynchronousIo IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter

shell32

CommandLineToArgvW IsUserAnAdmin SHGetFolderPathA

ws2_32

WSAGetLastError htons connect ntohs recv send WSACreateEvent listen select bind accept __WSAFDIsSet WSACleanup WSAStartup getsockname setsockopt ioctlsocket getpeername sendto recvfrom WSASocketW WSADuplicateSocketW getaddrinfo getsockopt shutdown WSARecv WSASend closesocket ntohl freeaddrinfo socket htonl inet_ntop inet_pton WSAIoctl WSARecvFrom WSACloseEvent GetAddrInfoW FreeAddrInfoW WSASetLastError

iphlpapi

ConvertInterfaceLuidToAlias GetIpForwardTable2 CancelIPChangeNotify ConvertInterfaceLuidToIndex CreateUnicastIpAddressEntry GetUnicastIpAddressTable ConvertLengthToIpv4Mask NotifyRouteChange2 CreateIpForwardEntry2 NotifyAddrChange CancelMibChangeNotify2 GetExtendedUdpTable ConvertInterfaceIndexToLuid GetIfEntry2 FreeMibTable DeleteIpForwardEntry2 SetIpInterfaceEntry GetAdaptersAddresses GetIpInterfaceEntry DeleteUnicastIpAddressEntry GetExtendedTcpTable InitializeUnicastIpAddressEntry ConvertInterfaceLuidToGuid

ole32

StringFromGUID2 CoInitializeEx CoCreateInstance CoUninitialize

shlwapi

PathRemoveFileSpecA StrStrIW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA

ntdll

NtQueryInformationProcess NtDeviceIoControlFile NtCancelIoFileEx NtOpenFile NtWriteFile NtCreateFile RtlNtStatusToDosError NtReadFile RtlGetVersion NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle SleepConditionVariableCS InitOnceExecuteOnce WakeConditionVariable WaitOnAddress InitializeConditionVariable

bcryptprimitives

ProcessPrng

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen

pdh

PdhAddEnglishCounterW PdhRemoveCounter PdhEnumObjectsA PdhOpenQueryA PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

psapi

GetProcessMemoryInfo GetModuleFileNameExW

wolfssl-fips

wolfSSL_get_peer_quic_transport_params wolfSSL_set_quic_transport_params wolfSSL_CTX_set_quic_method wolfSSL_EVP_EncryptInit_ex wolfSSL_quic_get_aead wolfSSL_EVP_CIPHER_CTX_free wolfSSL_EVP_EncryptFinal_ex wolfSSL_EVP_CipherUpdate wolfSSL_EVP_Cipher_key_length wolfSSL_EVP_CIPHER_iv_length wolfSSL_quic_aead_is_gcm wolfSSL_quic_aead_is_ccm wolfSSL_quic_aead_is_chacha20 wolfSSL_quic_get_aead_tag_len wolfSSL_quic_get_md wolfSSL_EVP_aes_128_ctr wolfSSL_EVP_aes_128_gcm wolfSSL_process_quic_post_handshake wolfSSL_get_app_data wolfSSL_SSL_get_wbio wolfSSL_RAND_bytes wolfSSL_SSL_get_rbio wolfSSL_set_tlsext_host_name wolfSSL_connect wolfSSL_get_ex_data_X509_STORE_CTX_idx wolfSSL_get_ex_data wolfSSL_BIO_set_mem_eof_return wolfSSL_CTX_set1_sigalgs_list wolfSSL_CTX_check_private_key wolfSSL_set_bio wolfSSL_set_ex_data wolfSSL_CTX_use_certificate wolfSSL_quic_do_handshake wolfSSL_quic_get_hp wolfDTLS_client_method wolfTLSv1_2_client_method wolfSSL_X509_STORE_CTX_get_error_depth wolfSSL_CTX_UseSessionTicket wolfSSL_OPENSSL_cleanse wolfSSL_quic_crypt_new wolfSSL_CTX_set1_groups_list wolfSSL_X509_STORE_CTX_set_error wolfSSL_CTX_use_PrivateKey wolfSSL_X509_STORE_CTX_get_current_cert wolfSSL_CTX_set_read_ahead wolfSSL_OPENSSL_free wolfSSL_ERR_clear_error wolfSSL_X509_STORE_CTX_get_ex_data wolfSSL_X509_STORE_add_cert wolfSSL_CTX_set_cipher_list wolfSSL_CTX_get_cert_store wolfSSL_CTX_set_verify wolfSSL_X509_STORE_CTX_get_error wolfCrypt_SetPrivateKeyReadEnable_fips wolfSSL_new wolfSSL_set_app_data wolfSSL_set_connect_state wolfSSL_set_quic_transport_version wolfSSL_set_accept_state wc_AesGcmEncrypt wc_AesGcmSetKey_fips wolfSSL_quic_aead_encrypt wc_InitSha256_fips wc_Sha256Update_fips wolfSSL_quic_aead_decrypt wolfSSL_GetAppgateCustomExtension wolfSSL_get_verify_result wolfSSL_X509_CRL_get_nextUpdate wolfSSL_X509_subject_name_hash wolfSSL_is_quic wolfSSL_get_SSL_CTX wolfSSL_X509_CRL_get_lastUpdate wolfSSL_read wolfSSL_provide_quic_data wolfSSL_get_peer_cert_chain wolfSSL_get_version wolfSSL_X509_verify_cert_error_string wolfSSL_EVP_MD_CTX_new wolfSSL_CertManagerGetCRL wolfSSL_i2d_X509 wolfSSL_X509_issuer_name_hash wolfSSL_free wolfSSL_EVP_sha256 wolfSSL_EVP_DigestUpdate wolfSSL_dtls_set_mtu wolfSSL_shutdown wolfSSL_alert_desc_string_long wolfSSL_quic_hkdf_extract wolfSSL_dtls_set_using_nonblock wolfSSL_get_current_cipher wolfSSL_CertManagerFreeCRL wolfSSL_get_alert_history wolfSSL_BIO_write wolfSSL_CertManagerEnableCRL wolfSSL_CIPHER_get_name wolfSSL_EVP_DigestFinal_ex wolfSSL_set_dtls_fd_connected wolfSSL_ERR_error_string_n wolfSSL_get_error wolfSSL_EVP_MD_CTX_free wolfSSL_write wolfSSL_EVP_DigestInit_ex wolfSSL_is_init_finished wolfSSL_AddAppgateCustomExtension wolfSSL_BIO_read wolfSSL_sk_DIST_POINT_value wolfSSL_sk_X509_value wolfSSL_sk_X509_num wolfSSL_ERR_error_string wolfSSL_quic_hkdf_expand wolfSSL_quic_hkdf wolfSSL_X509_verify wolfSSL_ASN1_STRING_to_UTF8 wolfSSL_CertManagerGetCerts Base64_Encode_NoNl wolfSSL_sk_X509_free wolfSSL_CTX_load_system_CA_certs wolfSSL_X509_get_pubkey wolfSSL_X509_NAME_print_ex LockMutex UnLockMutex InitMutex FreeMutex wolfSSL_EVP_PKEY_free wolfSSL_X509_cmp wolfSSL_i2d_PUBKEY wolfSSL_CTX_free wolfSSL_CTX_GetCertManager wolfSSL_BIO_get_mem_data wolfSSL_CTX_set_min_proto_version wolfSSL_GENERAL_NAMES_free wolfSSL_X509_get_der wolfSSL_CTX_load_verify_buffer wolfSSL_BIO_new wc_PKCS12_free wolfSSL_BIO_s_mem wolfSSL_CTX_new wolfSSL_X509_ALGOR_get0 wolfTLS_client_method wolfSSL_X509_get_notBefore wolfSSL_X509_free wolfSSL_X509_NAME_get_entry wolfSSL_X509_NAME_add_entry wolfSSL_d2i_X509 wolfSSL_CTX_set_max_proto_version wolfSSL_CertManagerCheckCRL wolfSSL_ASN1_TIME_print wolfSSL_Cleanup wolfSSL_X509_get0_tbs_sigalg wolfSSL_BIO_free wolfSSL_X509_NAME_cmp wolfSSL_ERR_remove_state wc_RunAllCast_fips wolfSSL_X509_get_subject_name wolfSSL_PKCS12_parse wolfSSL_CTX_EnableCRL wolfSSL_X509_cmp_time wolfSSL_sk_DIST_POINT_pop_free wolfIO_SetTimeout wc_d2i_PKCS12 wc_PKCS12_new Base64_Decode wolfSSL_X509_check_host wolfSSL_X509_NAME_new wolfSSL_X509_NAME_entry_count wolfSSL_X509_NAME_oneline wolfSSL_X509_NAME_free wolfSSL_X509_get_issuer_name wolfSSL_sk_GENERAL_NAME_value wolfSSL_X509_get_notAfter wolfSSL_sk_GENERAL_NAME_num wolfSSL_X509_get_ext_d2i wolfSSL_Init wolfSSL_X509_get_key_usage wolfSSL_OBJ_obj2nid wolfCrypt_GetVersion_fips wc_GetErrorString wolfCrypt_GetStatus_fips wc_FreeRng_fips wolfSSL_BIO_get_mem_ptr wc_RNG_GenerateBlock_fips wc_InitRng_fips wolfCrypt_SetCb_fips wc_Sha256Final_fips wolfSSL_get_peer_certificate

user32

TranslateMessage GetSystemMetrics MapVirtualKeyW GetMessageA DispatchMessageA

fwpuclnt

FwpmSubLayerGetByKey0 FwpmFilterAdd0 FwpmFilterDeleteById0 FwpmFreeMemory0 FwpmFilterGetById0 FwpmGetAppIdFromFileName0 FwpmProviderAdd0 FwpmEngineOpen0 FwpmSubLayerAdd0

userenv

RefreshPolicyEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx GetDateFormatEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW GetModuleHandleW GetModuleFileNameA

crypt32

CryptMsgGetParam CryptQueryObject CertCloseStore CryptMsgClose

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringOrdinal

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentVariableW FreeEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-processthreads-l1-1-0

ResumeThread TlsSetValue TlsAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection ReleaseSemaphore EnterCriticalSection ResetEvent SetEvent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-namedpipe-l1-1-0

SetNamedPipeHandleState CreateNamedPipeW PeekNamedPipe

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-namedpipe-ansi-l1-1-0

GetNamedPipeHandleStateA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-file-l1-1-0

GetLongPathNameW

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualProtect

api-ms-win-core-console-l2-1-0

WriteConsoleInputW FillConsoleOutputAttribute FillConsoleOutputCharacterW SetConsoleCursorInfo GetConsoleCursorInfo SetConsoleCursorPosition

api-ms-win-core-console-l1-1-0

GetNumberOfConsoleInputEvents ReadConsoleInputW

api-ms-win-core-errorhandling-l1-1-0

RaiseException

dnsapi

DnsReplaceRecordSetA

vcruntime140

memcmp memset memcpy __CxxFrameHandler3 strstr __C_specific_handler strrchr memmove strchr __current_exception __current_exception_context wcsstr memchr

api-ms-win-crt-runtime-l1-1-0

exit _configure_narrow_argv _set_app_type _initterm_e _exit terminate system _initialize_narrow_environment _crt_atexit _seh_filter_exe _initterm _get_initial_narrow_environment _register_onexit_function _beginthreadex _wassert __p___argv _initialize_onexit_table _cexit _c_exit abort __p___argc _errno _set_invalid_parameter_handler _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode setvbuf feof _fileno ferror fwrite __stdio_common_vsscanf fflush __stdio_common_vswprintf _close fread __acrt_iob_func __stdio_common_vfprintf _write __stdio_common_vsprintf fgets _set_fmode fclose _fsopen fopen

api-ms-win-crt-environment-l1-1-0

getenv _putenv

api-ms-win-crt-convert-l1-1-0

wcstombs_s atoi mbstowcs_s strtoul strtod

api-ms-win-crt-heap-l1-1-0

free realloc _set_new_mode malloc calloc

api-ms-win-crt-filesystem-l1-1-0

rename _stat64 _mkdir

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

strftime _gmtime64_s _time64 _localtime64_s

api-ms-win-crt-string-l1-1-0

strncpy wcslen _wcsnicmp _stricmp strtok_s strlen wcscpy_s _strnicmp isalnum strcpy_s isalpha tolower isdigit isspace wcsncpy _strdup strncmp strcmp

api-ms-win-crt-math-l1-1-0

sqrt pow __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

883KB

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_6d26c89f15e7ecda71a9f26799b2a848_akira_glassworm_rusty-stealer

advapi32

kernel32

shell32

ws2_32

iphlpapi

ole32

shlwapi

wtsapi32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

oleaut32

pdh

powrprof

psapi

wolfssl-fips

user32

fwpuclnt

userenv

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

crypt32

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-namedpipe-ansi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

dnsapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic