2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer
Size 5.7MB
Sample261107-tknefaztfv
SHA256 ce0d8cc44e962e04ac52e83ca23d397c631c533ad5c5e9d00ee5c63868db1fd4
MD5 24597c812e185cc67017779284e342a3
SHA1 11cb894eae7b2d7bcee3f74ac9202c94f69ca2bf
SHA512 a71d44dd72aec41a762db6e15f92848da3080aed924eadf3cafcf52e953520f317e541e2dfb3d688eeb989051c0f944d176d2edcdea4b3b3591e4bbc46f1ccef
SSDEEP 49152:5HD60gghOcs6kkMJh5dnrxMs/CbKGYOwED9ioI+TJqtQLnV581A0jqVy07W3YoNi:5Hu0gLFh5dnr6/HrBHA8T
TLSH
T1A456F7112A9B99ACD15AC87483464A735E2130DF1B36B9FF44C896393FA9AF41F3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer

File Explorer

2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer

.exe 5.7MB

2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer

IMPHASH cee7d884513daf5c2c2ac8ae0d0e1e35
SHA256 ce0d8cc44e962e04ac52e83ca23d397c631c533ad5c5e9d00ee5c63868db1fd4
MD5 24597c812e185cc67017779284e342a3
SHA1 11cb894eae7b2d7bcee3f74ac9202c94f69ca2bf
SHA512 a71d44dd72aec41a762db6e15f92848da3080aed924eadf3cafcf52e953520f317e541e2dfb3d688eeb989051c0f944d176d2edcdea4b3b3591e4bbc46f1ccef
SSDEEP 49152:5HD60gghOcs6kkMJh5dnrxMs/CbKGYOwED9ioI+TJqtQLnV581A0jqVy07W3YoNi:5Hu0gLFh5dnr6/HrBHA8T
TLSH
T1A456F7112A9B99ACD15AC87483464A735E2130DF1B36B9FF44C896393FA9AF41F3D318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4028300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

yxyl_peer_bridge.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

SetWaitableTimer GetFileAttributesW CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode IsProcessorFeaturePresent MultiByteToWideChar OpenProcess GetTickCount64 FindClose GetSystemTimeAsFileTime WriteConsoleW lstrlenW LockFileEx GetLastError GetModuleHandleA GetProcAddress FindFirstFileExW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte GetSystemInfo ExitProcess MoveFileExW GetCurrentProcessId GetCurrentThread SetThreadStackGuarantee CreateDirectoryW DuplicateHandle GetCurrentProcess GetStdHandle GetExitCodeProcess TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CreateFileW SwitchToThread GetSystemTimePreciseAsFileTime GetQueuedCompletionStatusEx GetSystemFirmwareTable FlushFileBuffers ReadFileEx SetHandleInformation CloseHandle CreateIoCompletionPort SetFileCompletionNotificationModes CreateThread GetCurrentThreadId PostQueuedCompletionStatus GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject Sleep CompareStringOrdinal HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStringsW FreeEnvironmentStringsW InitializeSListHead GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW LoadLibraryA HeapAlloc GetModuleFileNameW GetModuleHandleW FormatMessageW HeapFree IsDebuggerPresent GetProcessHeap UnhandledExceptionFilter AddVectoredExceptionHandler SetUnhandledExceptionFilter

ntdll

NtOpenFile NtReadFile NtCreateNamedPipeFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile

ws2_32

recv WSASend WSAGetLastError WSAIoctl connect ioctlsocket send getsockopt getaddrinfo bind listen getsockname WSAStartup closesocket setsockopt accept freeaddrinfo shutdown WSACleanup WSASocketW select

bcrypt

BCryptGenRandom

advapi32

CredDeleteW CredReadW CredWriteW SystemFunction036 CredFree

vcruntime140

memcpy __CxxFrameHandler3 memmove memcmp memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr round pow

api-ms-win-crt-runtime-l1-1-0

exit _exit _seh_filter_exe __p___argc __p___argv _set_app_type _cexit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _configure_narrow_argv _c_exit _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_24597c812e185cc67017779284e342a3_akira_glassworm_rusty-stealer

bcryptprimitives

api-ms-win-core-synch-l1-2-0

shell32

combase

kernel32

ntdll

ws2_32

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic