2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer
Size 28.4MB
Sample261102-m3d56abt5k
SHA256 70fe38dd617fc35dfa08cdfbd797894c9487dafa914e6ccba1d180d6c385f5dc
MD5 b5b4333d461fff92327bb1da2dd544bc
SHA1 22c75958addc3638b02fc24fb850e68b869e2dcb
SHA512 3b37d8f0aedd8af50ef96ec14e6122e9b79636bb365b10643821dab45c98df6020606435e312269c10e934f26ba3a6195f70df8f6b527a2c8538506e9359a531
SSDEEP 393216:DBGQcG/nbpb/J8fkZcDqqmtrWg/HIjIJ3CB:DBGQcG/nlb/J6k2DKtFJ3
TLSH
T133674A157A9F68ACD19AC870834B4A631A2174DB1B36BDFF40D482313FADBB45B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer

File Explorer

2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer

.exe 28.4MB

2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer

IMPHASH 06fda5015417acb784657b51c70192cd
SHA256 70fe38dd617fc35dfa08cdfbd797894c9487dafa914e6ccba1d180d6c385f5dc
MD5 b5b4333d461fff92327bb1da2dd544bc
SHA1 22c75958addc3638b02fc24fb850e68b869e2dcb
SHA512 3b37d8f0aedd8af50ef96ec14e6122e9b79636bb365b10643821dab45c98df6020606435e312269c10e934f26ba3a6195f70df8f6b527a2c8538506e9359a531
SSDEEP 393216:DBGQcG/nbpb/J8fkZcDqqmtrWg/HIjIJ3CB:DBGQcG/nlb/J6k2DKtFJ3
TLSH
T133674A157A9F68ACD19AC870834B4A631A2174DB1B36BDFF40D482313FADBB45B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18998332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pyrefly.pdb

bcryptprimitives

ProcessPrng

kernel32

SetConsoleCursorPosition FillConsoleOutputAttribute FindClose GetFileInformationByHandleEx SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee ReleaseSemaphore CreateSemaphoreW GetQueuedCompletionStatusEx WaitForSingleObject SetWaitableTimer SwitchToThread TerminateProcess GetProcAddress GetModuleHandleA Sleep GetLastError WriteConsoleA FreeLibrary GetCurrentProcessorNumber GetProcessTimes TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock WriteFile CreateWaitableTimerExW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus DeleteFileW SetFilePointerEx GetFileType GetFinalPathNameByHandleW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetSystemTimeAsFileTime GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW ReadFile GetOverlappedResult CreateEventW ExitProcess CreateDirectoryW ReadConsoleW IsDebuggerPresent GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW CreateThread FormatMessageW ReadFileEx WriteFileEx SleepEx WriteConsoleW GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId RtlLookupFunctionEntry GetCurrentThreadId FindNextFileW DuplicateHandle GetCurrentProcess CloseHandle SetLastError MoveFileExW SetFileAttributesW ReadDirectoryChangesW CancelIo WaitForSingleObjectEx CreateFileW GetSystemInfo FillConsoleOutputCharacterA InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter VirtualQuery VirtualFree VirtualAlloc GetEnvironmentVariableA GetModuleFileNameW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleW GetEnvironmentVariableW HeapFree HeapAlloc HeapReAlloc GetProcessHeap MultiByteToWideChar WideCharToMultiByte lstrlenW LoadLibraryA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler GetCommandLineW QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtReadFile RtlNtStatusToDosError NtOpenFile

userenv

GetUserProfileDirectoryW

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

psapi

GetProcessMemoryInfo

vcruntime140

memcmp __C_specific_handler strstr __current_exception_context _CxxThrowException memmove memset __CxxFrameHandler3 memcpy __current_exception

api-ms-win-crt-math-l1-1-0

ceil __setusermatherr pow truncf trunc round log2 log10 fmod exp2 floor

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_errno _set_app_type _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _configure_narrow_argv _crt_atexit _initialize_onexit_table _register_onexit_function _seh_filter_exe

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

_set_fmode fputs __acrt_iob_func __p__commode

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b5b4333d461fff92327bb1da2dd544bc_akira_glassworm_rusty-stealer

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

shell32

combase

advapi32

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic