2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer
Size 2.0MB
Sample261102-1lfvbaw1h1
SHA256 ea77e542d1495598c73070d15eadafc3390172ca33908add132d2330e3dcbf90
MD5 d3dce8ac3facbd88847b6f7988e19365
SHA1 f1bdf8138e76869a6d11582bf61bbb0d661c572d
SHA512 ab83b4ee1ea788b03b9be5617b059723bfb561b7aaf4852f394b48e5a6d926238dc52aa4917d3bd2a6aafd27f79ed247498bbe00e6c69344d5ad2cf5f5f98e1e
SSDEEP 49152:bGYJCDJffnLehTOZuuO7KBshczKh6v+RIkgq6+Ap86Keh0:CY0JffLZSA2Vmkgqsp8Gh
TLSH
T19DA5AE07F2A440E8D0ABC175C71A9327EB72B88A1630A7DB13E44B653F27E615FAD315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer

File Explorer

2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer

.exe 2.0MB

2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer

IMPHASH 8e69c22743e8fbf950be3476ebee2f85
SHA256 ea77e542d1495598c73070d15eadafc3390172ca33908add132d2330e3dcbf90
MD5 d3dce8ac3facbd88847b6f7988e19365
SHA1 f1bdf8138e76869a6d11582bf61bbb0d661c572d
SHA512 ab83b4ee1ea788b03b9be5617b059723bfb561b7aaf4852f394b48e5a6d926238dc52aa4917d3bd2a6aafd27f79ed247498bbe00e6c69344d5ad2cf5f5f98e1e
SSDEEP 49152:bGYJCDJffnLehTOZuuO7KBshczKh6v+RIkgq6+Ap86Keh0:CY0JffLZSA2Vmkgqsp8Gh
TLSH
T19DA5AE07F2A440E8D0ABC175C71A9327EB72B88A1630A7DB13E44B653F27E615FAD315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1687676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dsh_type.pdb

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError RtlGetVersion

kernel32

GetProcessHeap IsDebuggerPresent WideCharToMultiByte GetProcAddress GetModuleHandleA DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection GetSystemTimePreciseAsFileTime QueryFullProcessImageNameW SetThreadStackGuarantee GetCurrentThread HeapReAlloc EnterCriticalSection WaitForSingleObject SetLastError RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW InitializeCriticalSection MultiByteToWideChar HeapAlloc IsProcessorFeaturePresent FormatMessageW ExitProcess GetModuleFileNameW SetWaitableTimer RaiseException LoadLibraryW AreFileApisANSI ReadFile HeapCreate WriteFile GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile GlobalUnlock GetTempPathW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GlobalSize FlushViewOfFile CreateFileA DeleteFileA GetNativeSystemInfo GetSystemInfo HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GlobalLock GetFileSize SystemTimeToFileTime GetSystemTimeAsFileTime GlobalAlloc GetSystemTime FormatMessageA ReleaseMutex CreateFileMappingW LoadLibraryExA GetModuleHandleW MapViewOfFile FlushFileBuffers OutputDebugStringA OutputDebugStringW LoadLibraryExW InitializeSListHead LCIDToLocaleName GetUserDefaultUILanguage FreeLibrary TerminateProcess GetFileAttributesW GetCommandLineW CreateDirectoryW ReadConsoleW SwitchToThread GetCurrentProcessId HeapFree SleepConditionVariableSRW GetFileInformationByHandleEx GetFileInformationByHandle GetTickCount GetCurrentThreadId WakeAllConditionVariable SetFileTime AcquireSRWLockExclusive CreateFileW GetFullPathNameW QueryPerformanceCounter GetFileAttributesExW GlobalFree OpenProcess UnlockFileEx CreateMutexW CreateMutexA CreateThread CreateWaitableTimerExW GetCurrentProcess UnhandledExceptionFilter Sleep GetLastError CloseHandle SetUnhandledExceptionFilter ReleaseSRWLockExclusive FindNextFileW FindClose FindFirstFileExW GetStdHandle GetConsoleMode DeleteFileW MoveFileExW SetFileInformationByHandle AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlVirtualUnwind GetConsoleOutputCP QueryPerformanceFrequency WriteConsoleW GetEnvironmentVariableW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

oleaut32

VariantClear GetErrorInfo SysStringLen SysFreeString SetErrorInfo

user32

ChangeDisplaySettingsExW GetRawInputData RegisterRawInputDevices GetMenu ReleaseCapture MsgWaitForMultipleObjectsEx GetKeyboardLayout DestroyIcon GetSystemMenu RegisterWindowMessageA EnableMenuItem RegisterHotKey KillTimer CallNextHookEx GetClipboardOwner IsClipboardFormatAvailable GetClipboardSequenceNumber SetWindowPlacement SetForegroundWindow ShowWindow IsIconic GetClipboardData OpenClipboard CloseClipboard SetClipboardData EmptyClipboard RegisterClipboardFormatW IsWindow AdjustWindowRectEx UnregisterHotKey GetLastInputInfo SetWindowLongW GetActiveWindow MapVirtualKeyExW ToUnicodeEx ReleaseDC AttachThreadInput SetProcessDpiAwarenessContext ShowCursor GetWindowRect GetForegroundWindow MonitorFromPoint EnumDisplayMonitors TrackMouseEvent GetClientRect LoadCursorW SetWindowDisplayAffinity GetClipCursor ClipCursor GetWindowPlacement DestroyWindow EnumChildWindows DispatchMessageA GetMessageA IsProcessDPIAware GetDC RegisterClassExW InvalidateRgn SetWindowPos MapVirtualKeyW GetUpdateRect ValidateRect SetCursor FillRect GetMonitorInfoW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo SetCapture SystemParametersInfoW ClientToScreen GetWindowLongW ScreenToClient GetKeyboardState SetWindowLongPtrW SystemParametersInfoA SetPropW RegisterTouchWindow GetSystemMetrics SendMessageW DefWindowProcW RedrawWindow GetWindowLongPtrW PostThreadMessageW MonitorFromWindow TranslateMessage PostMessageW GetWindowThreadProcessId GetKeyState OpenInputDesktop GetUserObjectInformationW GetWindow GetCursorPos DispatchMessageW SetTimer AddClipboardFormatListener CreateWindowExW RegisterClassW UnhookWindowsHookEx GetMessageW PeekMessageW SetWindowsHookExW SendInput GetAsyncKeyState GetWindowTextW CloseDesktop SetFocus

ole32

CoInitializeEx CoCreateInstance PropVariantClear RevokeDragDrop OleInitialize RegisterDragDrop CoUninitialize

mfplat

MFCreateDXGIDeviceManager MFStartup MFCreateSample MFCreateMemoryBuffer MFCreateDXGISurfaceBuffer MFCreateMediaType MFTEnumEx

gdi32

CreateRectRgn DeleteObject CreateSolidBrush GetDeviceCaps

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass

shlwapi

SHCreateMemStream

propsys

VariantToBoolean VariantToInt32 VariantToPropVariant PropVariantToBSTR

d3d11

D3D11CreateDevice

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc

dxgi

CreateDXGIFactory1

shell32

SHAppBarMessage DragQueryFileW DragFinish

advapi32

RegGetValueW RegQueryValueExW RegCloseKey RegOpenKeyExW OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority EventUnregister EventWriteTransfer EventSetInformation EventRegister

bcryptprimitives

ProcessPrng

vcruntime140

memcpy memmove memcmp memset __CxxFrameHandler3 wcsrchr _purecall memchr strchr strrchr __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

round trunc _dclass fabs __setusermatherr roundf log floor

api-ms-win-crt-string-l1-1-0

wcscmp strspn strcmp strcspn _wcsicmp wcslen strlen strncmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _set_new_mode _msize free malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _get_initial_narrow_environment _initterm _set_app_type _seh_filter_exe _endthreadex _beginthreadex _initterm_e exit _exit _crt_atexit _register_onexit_function _initialize_narrow_environment _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit terminate __p___argc __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_d3dce8ac3facbd88847b6f7988e19365_akira_rusty-stealer

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

oleaut32

user32

ole32

mfplat

gdi32

dwmapi

imm32

comctl32

shlwapi

propsys

d3d11

combase

dxgi

shell32

advapi32

bcryptprimitives

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic