2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer
Size 2.6MB
Sample261030-ebxt7avyf1
SHA256 eaf2827d8ec588b865f77bfed62a77f8d563c1cdb9a2758b8f836c9430cb1fef
MD5 5bde23c7000ffb2b981562840cfd9cc7
SHA1 32954ef4373a3a25928933648f107d15f84200e8
SHA512 b94d8307c06f163c249fecf3a7713d5caa75714437b0d2bfca57a1c7d254506cb104a2a2dba3173b47153508821721ad3e03248144a40ddd5fa9d80c13c1daae
SSDEEP 49152:zBMtAU09YMdclDea94ViATk7h9nBEzsFQDC/R6MpeNOg0met8VYIU6iok9:ccCVQDY8n+o
TLSH
T19CC56D03F69580E8C06EC575C35AA633FA76B88E0A3472BF1BE45B212E66F505F1D709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer

File Explorer

2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer

.exe 2.6MB

2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer

IMPHASH c3b17d1847cc090b9327aaa0514af554
SHA256 eaf2827d8ec588b865f77bfed62a77f8d563c1cdb9a2758b8f836c9430cb1fef
MD5 5bde23c7000ffb2b981562840cfd9cc7
SHA1 32954ef4373a3a25928933648f107d15f84200e8
SHA512 b94d8307c06f163c249fecf3a7713d5caa75714437b0d2bfca57a1c7d254506cb104a2a2dba3173b47153508821721ad3e03248144a40ddd5fa9d80c13c1daae
SSDEEP 49152:zBMtAU09YMdclDea94ViATk7h9nBEzsFQDC/R6MpeNOg0met8VYIU6iok9:ccCVQDY8n+o
TLSH
T19CC56D03F69580E8C06EC575C35AA633FA76B88E0A3472BF1BE45B212E66F505F1D709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2024988

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zapretUI_svc.pdb

kernel32

Sleep CreateDirectoryW GetFileInformationByHandleEx FindNextFileW SetConsoleCtrlHandler GetFileInformationByHandle GetProcessHeap FindFirstFileExW SetFileInformationByHandle SetFileTime LoadLibraryExA GetProcessId FindClose CancelIoEx DeleteFileW CreateFileW SetWaitableTimer GetModuleHandleA TerminateProcess CreateThread SetHandleInformation GetModuleHandleW WriteFileEx SleepEx ReadFileEx HeapAlloc RemoveDirectoryW CopyFileExW Process32NextW WriteConsoleW GetConsoleOutputCP GetConsoleMode CreateIoCompletionPort GetFileAttributesW SetFileCompletionNotificationModes GetStdHandle ConnectNamedPipe ReleaseMutex CreateMutexA GetTempPathW GetProcAddress LoadLibraryA GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError WaitForSingleObjectEx ReadFile PostQueuedCompletionStatus CreateJobObjectW SetInformationJobObject AssignProcessToJobObject WriteFile GetOverlappedResult CreateNamedPipeW CreateWaitableTimerExW GetExitCodeProcess FormatMessageW Process32FirstW SwitchToThread CreateToolhelp32Snapshot DuplicateHandle WaitForSingleObject MoveFileExW HeapReAlloc GetCurrentProcessId LocalAlloc FlushFileBuffers OpenMutexW CloseHandle GetCurrentThread SetThreadStackGuarantee GetCurrentThreadId GetCurrentProcess GetLastError LocalFree IsProcessorFeaturePresent CreateProcessW GetModuleFileNameW OpenProcess HeapFree GetFullPathNameW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW MultiByteToWideChar WideCharToMultiByte lstrlenW GetSystemDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetCommandLineW GetCurrentDirectoryW SetUnhandledExceptionFilter GetSystemInfo GetSystemTimeAsFileTime GetWindowsDirectoryW

advapi32

SetSecurityDescriptorDacl GetSecurityDescriptorSacl SetSecurityDescriptorSacl SetSecurityDescriptorOwner GetSecurityDescriptorGroup SetSecurityDescriptorGroup FreeSid InitializeSecurityDescriptor IsValidSid StartServiceCtrlDispatcherW GetSidLengthRequired CloseServiceHandle CopySid GetAclInformation InitializeAcl GetAce AddAce GetSecurityDescriptorControl SetSecurityDescriptorControl AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetNamedSecurityInfoW GetSecurityDescriptorOwner StartServiceW ChangeServiceConfig2W OpenSCManagerW OpenServiceW GetSidSubAuthorityCount ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetKeyValueW RegDeleteKeyValueW RegDeleteTreeW DeleteService ControlService ChangeServiceConfigW QueryServiceStatusEx SetServiceStatus CreateServiceW GetSecurityDescriptorDacl RegisterServiceCtrlHandlerExW SystemFunction036

oleaut32

VariantClear SysAllocStringLen GetErrorInfo SysFreeString SysStringLen

user32

PostMessageW FindWindowW MessageBoxW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSAStartup WSASend getsockopt connect bind WSAGetLastError WSAIoctl WSACleanup WSASocketW getaddrinfo freeaddrinfo closesocket ioctlsocket recv send setsockopt

ntdll

NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtReadFile NtOpenFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile

shell32

ShellExecuteExW IsUserAnAdmin

ole32

CoInitializeEx CoCreateInstance CoUninitialize

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen WinHttpConnect

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __C_specific_handler __CxxFrameHandler3 memmove memset memcmp memcpy __current_exception_context

api-ms-win-crt-math-l1-1-0

exp2f __setusermatherr pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e _initialize_narrow_environment exit _crt_atexit _initialize_onexit_table _exit __p___argc _configure_narrow_argv terminate __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_5bde23c7000ffb2b981562840cfd9cc7_akira_rusty-stealer

kernel32

advapi32

oleaut32

user32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

shell32

ole32

iphlpapi

winhttp

bcryptprimitives

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic