2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer
Size 863KB
Sample261102-t447asff63
SHA256 ca74bc391ffc321374710ddee428225c81520697cd4fbfa9a973a1fe94155f5e
MD5 7ffe93563bcfc1ca05a00972861b33c1
SHA1 764a44c16786f2be78a34cef04d0b2e1b94fb32c
SHA512 5ffc5d1c1a5bc84780bc07eed20fd25bfc3f04d60ec168cfb763084e907155e1bbc56fbcc6ede7f0034f6adad3d0b47ce160066d63324385db1cb9bc3536e8d2
SSDEEP 12288:ph0tJmjJuU9Ijn/uHvz/zSUrSg13XD7HMMOacPz79j1rQQl:phWU9Ij/uHLzSUWgN7sMOrz79ja
TLSH
T1FB152921BA5A69ACC05AC43483474A736A7170CB1B31ADFF71DC56383FA9AF51F39218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer

File Explorer

2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer

.exe 863KB

2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer

IMPHASH 2b31497d8d467dbd578d1841bfe96443
SHA256 ca74bc391ffc321374710ddee428225c81520697cd4fbfa9a973a1fe94155f5e
MD5 7ffe93563bcfc1ca05a00972861b33c1
SHA1 764a44c16786f2be78a34cef04d0b2e1b94fb32c
SHA512 5ffc5d1c1a5bc84780bc07eed20fd25bfc3f04d60ec168cfb763084e907155e1bbc56fbcc6ede7f0034f6adad3d0b47ce160066d63324385db1cb9bc3536e8d2
SSDEEP 12288:ph0tJmjJuU9Ijn/uHvz/zSUrSg13XD7HMMOacPz79j1rQQl:phWU9Ij/uHLzSUWgN7sMOrz79ja
TLSH
T1FB152921BA5A69ACC05AC43483474A736A7170CB1B31ADFF71DC56383FA9AF51F39218
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

562800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

open_kind-5c8a7301cf05f224.pdb

gdi32

DeleteObject DeleteDC

kernel32

IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime CloseHandle ReadFile GetModuleHandleW GetLastError GetProcessHeap HeapAlloc HeapFree LoadLibraryA GetProcAddress FormatMessageW WideCharToMultiByte GetCurrentProcessId MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW QueryFullProcessImageNameW Process32NextW OpenProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW ReadFileEx GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

MessageBoxW

advapi32

RegGetValueW

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtOpenFile NtReadFile

userenv

GetUserProfileDirectoryW

vcruntime140

memcpy __current_exception_context __CxxFrameHandler3 __current_exception __C_specific_handler _CxxThrowException memcmp memset memmove

api-ms-win-crt-math-l1-1-0

__setusermatherr floor fmod

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _initialize_narrow_environment _cexit _initialize_onexit_table __p___argv __p___argc _configure_narrow_argv _exit exit _get_initial_narrow_environment _initterm_e _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_7ffe93563bcfc1ca05a00972861b33c1_akira_rusty-stealer

gdi32

kernel32

api-ms-win-core-synch-l1-2-0

user32

advapi32

bcryptprimitives

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic