7c5462455dec34504daae2b5e2e39b780f03acd73a9a43318d68d55827b1a204

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_bb2578ed4ce4a98a2d747cd0c97d0bb8_akira_glassworm_rusty-stealer.exe
Size 4.5MB
Sample261102-mfbfragy7x
SHA256 7c5462455dec34504daae2b5e2e39b780f03acd73a9a43318d68d55827b1a204
MD5 bb2578ed4ce4a98a2d747cd0c97d0bb8
SHA1 8e6a7de81ba75ceb39e5112e67d93efd8020716a
SHA512 c4451a8fb21c43376364129ca9ef976d80e970e9bfa5a1d48b7410c4e094a3bba96ae82d5fde6c4feacc4d53ccea7b1f28f3b583a99e1572ed485efe2617aa5d
SSDEEP 49152:f6gNaohvoiV7uEyVPA2oeeR1mhOXdJ4tJC6X0BuxEBUy3m3KQXICXpjxub30GZ3w:oo7J1mhOXdJKCPuThYGO30GYRhkcU+
TLSH
T18D267B03F26252E8C06AC5B4535AA232F7353C8D432579EF5BD09B212E65FD06B3DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3628	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	2026-11-01_bb2578ed4ce4a98a2d747cd0c97d0bb8_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3628	3688	2026-11-01_bb2578ed4ce4a98a2d747cd0c97d0bb8_akira_glassworm_rusty-stealer.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-11-01_bb2578ed4ce4a98a2d747cd0c97d0bb8_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_bb2578ed4ce4a98a2d747cd0c97d0bb8_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Deletes itself
  PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3628-0-0x000001A8826E0000-0x000001A8826E1000-memory.dmp

Download