MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
SHA3-384 hash: 610b4cbcb70dc42e0fc609b01b7617eadfdb92ab6a4b93fdcbf234c17a454fc35e20999161ad60131dee651eef7ef15c
SHA1 hash: 8c54708c13ee136463ceaa851d05ddd70acf22b4
MD5 hash: 0e98bfb0d8595ceb9a687906758a27ad
humanhash: batman-louisiana-whiskey-william
File name:28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
Download: download sample
Signature RustyStealer
Create hunting rule
File size:569'344 bytes
First seen:2025-06-11 08:27:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c55d188c13de422ccc2a73da49d17658 (1 x RustyStealer)
ssdeep 12288:xDhxOiZwrkviJY5WyzwUhWV9ChFa8s/Pd9mCcq:xDhxn2rOiJY43Ujj6tXj
TLSH T179C47C56EA9511FCD05AC07487478A33B972B8860B35BDFF07D486362E2AAE16F3D710
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter TheRavenFile
Tags:akira exe Ransomware RustyStealer


Avatar
RakeshKrish12
Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/Akira%20Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
IN IN
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e.exe
Verdict:
No threats detected
Analysis date:
2025-06-04 07:45:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5963f766-c105-4d34-b3f2-de8d2644813a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8911/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68493e3607b5e8c1cfe63ca4
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
akira anti-debug anti-vm cmd lolbin microsoft_visual_cc ransomware
Link:
https://www.filescan.io/uploads/68493e2a171e01f9593cbcf1/reports/24267994-dfe7-48bd-be9c-ee3595bc7402/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
Malware family:
Akira Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/719bbf08-f40a-4298-8e2b-a341ee914232
Result
Threat name:
Akira
Create hunting rule
Detection:
malicious
Classification:
rans
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1712012
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Akira Ransomware
Behaviour
Behavior Graph:
Download SVG
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e/
Threat name:
Win64.Ransomware.Megazord
Create hunting rule
Status:
Malicious
First seen:
2024-04-10 22:51:07 UTC
File Type:
PE+ (Exe)
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdhkaath7iypwy7ibi6dwgj33hgsupkg3wnontw6l6jsvqk4pyxa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250611-kc16wsynz8/
Verdict:
Malicious
Tags:
Multios.Ransomware.Megazord-10021030-1
YARA:
n/a
Link:
https://app.threat.zone/submission/9a65359e-4640-4356-9a30-4873cfa9e1f3
Unpacked files
SH256 hash:
28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
MD5 hash:
0e98bfb0d8595ceb9a687906758a27ad
SHA1 hash:
8c54708c13ee136463ceaa851d05ddd70acf22b4
Detections:
AkiraRansomare
Create hunting rule
Link:
https://www.unpac.me/results/5d2ffde4-04de-4842-aac6-cfc8eaa318fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_WIN_Megazord_Apr25
Create hunting rule
Author:0x0d4y-Icaro Cesar
Description:This Yara rule from ISH Tecnologia's Heimdall Security Research Team, detects the main components of the Megazord Ransomware
Reference:https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf
Rule name:Multi_Ransomware_Akira_21842eb3
Create hunting rule
Author:Elastic Security
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/8911/

Comments