2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer
Size 734KB
Sample261029-xfe42sd181
SHA256 5afe8b8df4200258a62f87ff70a7cfb2b64933d177e097c4812ee6db214b1b32
MD5 c8f1498beb24a59d5e0103c6095e84f5
SHA1 aac225f7499fc37849de91b836e205bb48d549c6
SHA512 7c9b697fe6405d913ddce1dd2410b9b56cb61c5031897daadf1ff9b3c77d0edd33841c5f4d097b65a43a83e38cf498a5cb97474faab9ff1ccee7be699115cbe5
SSDEEP 12288:9Mfd4I/F+QFCcwYEF0OGQLh3W2toF+6s/WeUHj65H:9qyI/3CJYEqOGQLUI66WH
TLSH
T105F45C13FA5585E9C55DC038875686337633B88E4B3176EF22D86A293E6BEE11F2C304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer

File Explorer

2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer

.exe 734KB

2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer

IMPHASH 57600840a6305c4172343f05a3f32337
SHA256 5afe8b8df4200258a62f87ff70a7cfb2b64933d177e097c4812ee6db214b1b32
MD5 c8f1498beb24a59d5e0103c6095e84f5
SHA1 aac225f7499fc37849de91b836e205bb48d549c6
SHA512 7c9b697fe6405d913ddce1dd2410b9b56cb61c5031897daadf1ff9b3c77d0edd33841c5f4d097b65a43a83e38cf498a5cb97474faab9ff1ccee7be699115cbe5
SSDEEP 12288:9Mfd4I/F+QFCcwYEF0OGQLh3W2toF+6s/WeUHj65H:9qyI/3CJYEqOGQLUI66WH
TLSH
T105F45C13FA5585E9C55DC038875686337633B88E4B3176EF22D86A293E6BEE11F2C304
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

487532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sparkmc.pdb

kernel32

CloseHandle GetModuleHandleA HeapReAlloc HeapFree GetProcessHeap GetSystemTimeAsFileTime LoadLibraryA GetProcAddress SetLastError HeapAlloc GetModuleHandleW SetHandleInformation DuplicateHandle GetModuleFileNameW GetWindowsDirectoryW GetSystemDirectoryW GetLastError ReadConsoleW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead SetFilePointerEx Sleep SetWaitableTimer CreateWaitableTimerExW DeleteFileW WaitForMultipleObjects GetFileAttributesW CreateProcessW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW ReadFile GetOverlappedResult CancelIo CreateEventW ExitProcess CreateDirectoryW IsProcessorFeaturePresent GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency ReadFileEx GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetCurrentDirectoryW RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW SwitchToThread FindNextFileW FindClose GetCommandLineW GetConsoleWindow AllocConsole GetConsoleMode SetConsoleMode GetStdHandle WaitForSingleObject GetExitCodeProcess TerminateProcess WriteFileEx SleepEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx

crypt32

CertDuplicateStore CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertOpenStore CertFreeCertificateContext CertDuplicateCertificateChain CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateChain

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW DecryptMessage EncryptMessage InitializeSecurityContextW AcquireCredentialsHandleA AcceptSecurityContext FreeContextBuffer

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

getsockname WSAGetLastError WSAStartup WSACleanup WSADuplicateSocketW getsockopt select connect freeaddrinfo recv WSARecv WSASocketW getaddrinfo send WSASend setsockopt ioctlsocket closesocket getpeername

vcruntime140

memcmp __CxxFrameHandler3 memcpy memset __current_exception_context __current_exception __C_specific_handler memmove

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _initterm_e _initterm _get_initial_narrow_environment exit _set_app_type _initialize_narrow_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _configure_narrow_argv _exit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_c8f1498beb24a59d5e0103c6095e84f5_akira_glassworm_rusty-stealer

kernel32

crypt32

ntdll

secur32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic