MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b
SHA3-384 hash: dbb6cf30eff347103298a1d3cb95ee62295526ee9fa2bde425b388de61170a5aa86fe150c44f033901e58f541aeecc02
SHA1 hash: 8bdd31e8c1684d4a2189a315faba54b94b1f0c35
MD5 hash: 11d819f54b3f00a4b75c480a3f964cf9
humanhash: pizza-indigo-apart-texas
File name:RustMe.exe
Download: download sample
File size:591'360 bytes
First seen:2025-08-19 08:23:46 UTC
Last seen:2025-08-19 14:22:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6031431b1cf23da77349063598350e
ssdeep 6144:aYsFXzcytcGvpuxB98rumTxo1gZQsM31mpOdMQKa1uSzw+s3n0mzxhdy2Pv:TsFjcJUFQsM38pkI+s3ZPk2Pv
TLSH T17FC4D713AFE28ED7D8DE82B894822301FAD4AC901F2707D7D5575131AE737D62D26BA0
TrID 49.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
31.8% (.EXE) Win64 Executable (generic) (10522/11/4)
6.1% (.EXE) OS/2 Executable (generic) (2029/13)
6.0% (.EXE) Generic Win/DOS Executable (2002/3)
6.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 8631b0980d28f0d8
Reporter skocherhan
Tags:exe github-d1ovu


Avatar
skocherhan
https://github.com/d1ovu/pon/raw/refs/heads/main/RustMe.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
49
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
res.bat
Verdict:
Malicious activity
Analysis date:
2025-08-19 08:26:51 UTC
Tags:
github auto-startup
Link:
https://app.any.run/tasks/2198f259-0974-43cc-87da-fb9967227b39

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22125/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.17354374.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a434c98fd55a79c529285b
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug keylogger mingw overlay threat
Link:
https://www.filescan.io/uploads/68a434cea4bdac9f5b9ddb99/reports/6acbe782-52c4-40f8-b302-1e0de35417be/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cc7b79b2-a6cc-44a6-bf1f-4660ac816d11
Score:
34%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/11d819f54b3f00a4b75c480a3f964cf9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b/
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 08:24:36 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=azcr2yyblwcflb4rze53ih2omxpiu6ulit6y7fjvn5tf7vptaonq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250819-kazv2shr7x/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/179d1d13-ff82-4710-a0df-dee88d8c20d6
Unpacked files
SH256 hash:
06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b
MD5 hash:
11d819f54b3f00a4b75c480a3f964cf9
SHA1 hash:
8bdd31e8c1684d4a2189a315faba54b94b1f0c35
Link:
https://www.unpac.me/results/eb8ca487-c64b-4e19-986e-3bb7f83eb588/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 06451d63015d84558791c93bb41f4e65de8a7a8b44fd8f95356f665fd5f3039b

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/22125/
  
URLhaus
https://urlhaus.abuse.ch/url/3606767/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::MoveFileA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameA

Comments