🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464
SHA3-384 hash: 68c956aae0d2053508c72808f96a8bc5cbbae476d53b519ced4a8f8e0e09b1637cdb9ccbc74519d7c79816b6e91fd1b7
SHA1 hash: c65fa3cdb2f5cd11178dc221d10833feb88a284c
MD5 hash: 7752b73637e9a20517679d9b2bcea429
humanhash: missouri-wisconsin-alabama-aspen
File name:21cd4c92d96f5359.bin
Download: download sample
Signature RustyStealer
Create hunting rule
File size:2'242'048 bytes
First seen:2026-10-31 06:24:40 UTC
Last seen:2026-10-31 07:18:15 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 603a12af845feb44eeaee4af0f3efa0b (13 x RustyStealer)
ssdeep 49152:Hyq6rhizXRpuk+XZDh5KyR7F/ao3WwIU6istJ6:HydQgJFSTP+s
TLSH T177A58E03E69580ECD55ECC78C3479A73EA36B88D0921B6AB17D09B152E36F905F0DB1E
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Tuxxin
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
196
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-31 06:25:24 UTC
Tags:
ip-check stealer rustystealer auto-reg xor-url generic
Link:
https://app.any.run/tasks/84c001de-5e23-4594-a6d4-27135d88485e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96331/
Detection(s):
MiscreantPunch.SingleXOR.EXE.232.UNOFFICIAL
Create hunting rule

MiscreantPunch.SingleXOR.EXE.72.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae589d7b121dd519dcf02e8
Tags:
malware
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 cmd crypto evasive evasive expand explorer explorer fingerprint hacktool lolbin lolbin masquerade mingw obfuscated packed packed reconnaissance stealer vmprotect xor-pe xor-pe xor-url
Link:
https://www.filescan.io/uploads/6ae589d422464f9b6840723e/reports/2902684d-9dac-4d40-8a8c-fb6281fb6836/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464
Verdict:
Unknown
File Type:
exe x64
First seen:
2026-10-28T10:39:00Z UTC
Last seen:
2026-11-02T03:54:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/74a0f893-d8b1-4acc-a1df-60d9f9964663
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1995711
Signature
Creates multiple autostart registry keys
Found API chain indicative of debugger detection
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Uses ipconfig to lookup or modify the Windows network settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995711 Sample: 21cd4c92d96f5359.bin.exe Startdate: 31/10/2026 Architecture: WINDOWS Score: 68 55 api.ipify.org 2->55 63 Multi AV Scanner detection for submitted file 2->63 65 Joe Sandbox ML detected suspicious sample 2->65 8 21cd4c92d96f5359.bin.exe 2 2->8         started        12 21cd4c92d96f5359.bin.exe 2->12         started        14 21cd4c92d96f5359.bin.exe 1 2->14         started        16 12 other processes 2->16 signatures3 process4 dnsIp5 57 176.65.144.144, 80 DEDIK-CHGB Switzerland 8->57 59 api.ipify.org 172.67.74.152, 443, 49713, 49718 CLOUDFLARENET-CloudflareIncUS Canada 8->59 67 Found API chain indicative of debugger detection 8->67 69 Creates multiple autostart registry keys 8->69 18 cmd.exe 1 8->18         started        33 3 other processes 8->33 71 Found direct / indirect Syscall (likely to bypass EDR) 12->71 21 cmd.exe 12->21         started        23 cmd.exe 14->23         started        25 cmd.exe 1 14->25         started        27 cmd.exe 14->27         started        29 cmd.exe 1 16->29         started        31 cmd.exe 16->31         started        35 21 other processes 16->35 signatures6 process7 signatures8 61 Uses ipconfig to lookup or modify the Windows network settings 18->61 39 2 other processes 18->39 37 conhost.exe 21->37         started        41 4 other processes 23->41 43 2 other processes 25->43 45 2 other processes 27->45 47 2 other processes 29->47 49 2 other processes 31->49 51 5 other processes 33->51 53 29 other processes 35->53 process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/7752b73637e9a20517679d9b2bcea429
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464/
Threat name:
Win64.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-10-28 04:57:08 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehguzewzn5jvsdmp5qshs3g3pqsoi7fmmxn26abqglij5jeucrsa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261031-g6s6lavvbs/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Adds Run key to start application
Looks up external IP address via web service
Unpacked files
SH256 hash:
21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464
MD5 hash:
7752b73637e9a20517679d9b2bcea429
SHA1 hash:
c65fa3cdb2f5cd11178dc221d10833feb88a284c
Detections:
SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Link:
https://www.unpac.me/results/6189e780-2330-4140-b11c-7e5cee8c2413/
SH256 hash:
6d12639d9b06023d7ed5c180a0ed87b4b334d22bc56ff381b0e0dac82339b31f
MD5 hash:
d5b5eb8596ddca773ac56dfc6d9499f9
SHA1 hash:
2540b96c0919ca45617cf3d28c7be10ffecbdf24
Link:
https://www.unpac.me/results/6189e780-2330-4140-b11c-7e5cee8c2413/
SH256 hash:
37b3428b9cc767bca5fa36d7e2825fc43e6c4bdfa14b43e3c60dd0e66fd01e5a
MD5 hash:
f641db7b4d62078984cfd2f832fd7574
SHA1 hash:
53157fe905402da313753c2ff7a023bd4621ad10
Link:
https://www.unpac.me/results/6189e780-2330-4140-b11c-7e5cee8c2413/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 21cd4c92d96f53590d8fec24796cdb7c24e47cac65dbaf003032d09ea4941464

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/96331/

Comments