MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2452b076ea5c2677bc20fb79b21f52fe5f85168c6115955e51b8a0c73dc72e2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2452b076ea5c2677bc20fb79b21f52fe5f85168c6115955e51b8a0c73dc72e2a
SHA3-384 hash: e5232dcf37b116dd0057dfd27ba23d227d41772cb05c36d2fa523362ed6d06a1a9475623e20e8c362414fdfa1552922e
SHA1 hash: 80bc72747314eca557fbfcc0275fbffcb9b749df
MD5 hash: 5186e144010d4dd2cad53c7160832be3
humanhash: grey-carbon-zulu-kentucky
File name:file
Download: download sample
Signature RustyStealer
Create hunting rule
File size:432'399 bytes
First seen:2023-01-23 12:11:30 UTC
Last seen:2023-01-23 12:46:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7eae418c7423834ffc3d79b4300bd6fb (51 x GuLoader, 16 x RemcosRAT, 15 x AgentTesla)
ssdeep 1536:Hpe6linkVlM4nAyO0DVPYuVN2y5esqFI+PlFwIrt:H8UWylM4JDVPYuL2y5ffWlFwIh
Threatray 188 similar samples on MalwareBazaar
TLSH T15194D4403201DD87CD4849F01DA5E6B620B47FA7696EBA0B778437FE76FAEB1801E251
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 80a4a6a4a6a6a480 (1 x RustyStealer)
Reporter andretavare5
Tags:exe RustyStealer


Avatar
andretavare5
Sample downloaded from http://altairsoftware.link/InstallSetup3.exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-23 12:13:34 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/168458a6-f3fd-45fd-ac32-8c4c942fefd9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/355862/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
DNS request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/62442/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
ficker overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63ce7993696b2d9725741436/reports/f007863b-53f3-4d89-92f1-a8c3bad7cd29/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
FickerStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65135246-54e2-4662-b519-310ef4fbd197
Result
Threat name:
Ficker Stealer, Rusty Stealer
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1156935
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Yara detected Ficker Stealer
Yara detected Rusty Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 789667 Sample: file.exe Startdate: 23/01/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Multi AV Scanner detection for domain / URL 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 7 other signatures 2->51 7 file.exe 34 2->7         started        process3 dnsIp4 25 erergw.link 7->25 27 djqnef.gives 185.251.89.40, 49699, 80 SPRINTHOSTRU Russian Federation 7->27 29 iplogger.com 148.251.234.93, 443, 49704 HETZNER-ASDE Germany 7->29 19 C:\Users\user\AppData\Local\...\INetC.dll, PE32 7->19 dropped 21 C:\Users\user\AppData\...\RuntimeWorker3.exe, PE32 7->21 dropped 23 C:\Users\user\...\RuntimeWorker3[1].exe, PE32 7->23 dropped 53 May check the online IP address of the machine 7->53 12 RuntimeWorker3.exe 7->12         started        file5 signatures6 process7 signatures8 55 Multi AV Scanner detection for dropped file 12->55 57 Detected unpacking (changes PE section rights) 12->57 59 Detected unpacking (overwrites its own PE header) 12->59 61 4 other signatures 12->61 15 RuntimeWorker3.exe 16 12->15         started        process9 dnsIp10 31 wejqwed.link 90.156.230.53, 49707, 8080 MASTERHOST-ASMoscowRussiaRU Russian Federation 15->31 33 api4.ipify.org 64.185.227.155, 49705, 80 WEBNXUS United States 15->33 35 api.ipify.org 15->35 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->37 39 Tries to steal Instant Messenger accounts or passwords 15->39 41 Tries to harvest and steal browser information (history, passwords, etc) 15->41 43 Tries to harvest and steal Bitcoin Wallet information 15->43 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2452b076ea5c2677bc20fb79b21f52fe5f85168c6115955e51b8a0c73dc72e2a/
Threat name:
Win32.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-01-21 22:39:39 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
9 of 39 (23.08%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=erjla5xklqthppba7n43eh2s7zpykfummekzkxsrxcqmopohfyva._file
Verdict:
malicious
Similar samples:
087e07ea636995a1249f0196c4cf9e228c8112e44171d5fdcda61fcbc72ac39a
RustyStealer
31d722331a9890b3ac394bf19fa6246397fbf79b37f23bc3fdde850afbc319ae
RustyStealer
51837ac7f938c666b56d73e1e38f8d75dae2c6116ec2bc49fd992fa6aeab6546
RustyStealer
c292e86c72bcfc610e735fb8eae67990cc834892e4a199a4b20b3e0de5eb14d1
RustyStealer
fc583f0b1db0e61fd38fa6d02280554a392550ea905e2f1054602aba3aca42f9
RustyStealer
+ 178 additional samples on MalwareBazaar
Result
Malware family:
fickerstealer
Create hunting rule
Score:
  10/10
Tags:
family:fickerstealer discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230123-pc6htseg4t/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Reads local data of messenger clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Fickerstealer
Malware Config
C2 Extraction:
wejqwed.link:8080
Unpacked files
SH256 hash:
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 hash:
40d7eca32b2f4d29db98715dd45bfac5
SHA1 hash:
124df3f617f562e46095776454e1c0c7bb791cc7
Link:
https://www.unpac.me/results/0e08bc24-f00d-4c2c-9c74-612ae67a1e6d/
SH256 hash:
2452b076ea5c2677bc20fb79b21f52fe5f85168c6115955e51b8a0c73dc72e2a
MD5 hash:
5186e144010d4dd2cad53c7160832be3
SHA1 hash:
80bc72747314eca557fbfcc0275fbffcb9b749df
Link:
https://www.unpac.me/results/0e08bc24-f00d-4c2c-9c74-612ae67a1e6d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2452b076ea5c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2452b076ea5c2677bc20fb79b21f52fe5f85168c6115955e51b8a0c73dc72e2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:Windows_Trojan_Fickerstealer_f2159bec
Create hunting rule
Author:Elastic Security
Rule name:win_fickerstealer_w0
Create hunting rule
Author:Ben Cohen, CyberArk
Description:Yara rule for Ficker Stealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/355862/
  
URLhaus
https://urlhaus.abuse.ch/url/2516355/

Comments