🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 31 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3
SHA3-384 hash: 99cae0cb8e65f663589e40edb935727bae8931d1102002d68ac7857d39772d834e7335ffdfe378a716e694efc4ca9783
SHA1 hash: 606767bb4d2462f9b70e3b2e4fda152c93e44cb7
MD5 hash: 92538ed809c5b77e8582be4fedd307fd
humanhash: eleven-alanine-lion-winter
File name:51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3.bin
Download: download sample
Signature RustyStealer
Create hunting rule
File size:9'417'671 bytes
First seen:2026-09-30 10:12:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:OZofd9Y6YRe6KmxoVnlLHeElIbjSC02wSicFERjkf2bz1JgMl2m:OZU9Y5e6Kmxo/L+jvSC0Fcwj2m1J/ld
TLSH T1939633E8695387A61D49A77F90516B93BA0C39CDAD42D5042712E8F41A090F3A7B3BFC
TrID 69.2% (.ZIP) OpenClaw skill package (9000/1/1)
30.7% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter whack_sh
Tags:RustyStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
US US
File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:payload\skills\thorp-browser\references\api.md
File size:12'018 bytes
SHA256 hash: fef0cc0b8295ab92e4843934a2f0b65fce9fd06ca4a9680f09b5442e48ecad44
MD5 hash: 261209c87a0e893b77f979277e8ad1d8
MIME type:text/plain
Signature RustyStealer
File name:Install-Thorp.cmd
File size:243 bytes
SHA256 hash: 14704a05445c2ad6bd76c0743173aa3c22e3d547c929abb97c6373e1f2b79763
MD5 hash: 9c5b9d567e0e225af445230f4ad8be06
MIME type:text/x-msdos-batch
Signature RustyStealer
File name:install-user.ps1
File size:7'047 bytes
SHA256 hash: 0852bf4e37ca3b3b10383523e47baa2a036922fd59ead1859a363758a614549a
MD5 hash: d4d469b9b33e5333465ffd12c02b49b0
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\agents\openai.yaml
File size:316 bytes
SHA256 hash: 599f01c82958f1bf32fb2aefe146ef9e4cb28b694663dad78b1cffee964c98f3
MD5 hash: fb9fa167e28660dbbdd19477cd6c3e3d
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\scripts\thorp_local.py
File size:20'414 bytes
SHA256 hash: 3b89945aa32144a7e99498ee1d937a489d4aee10fe44e051be8ffd6bd42d4d26
MD5 hash: 918adcd8f4c7a45ffd5a5cb5043eaf85
MIME type:text/x-python
Signature RustyStealer
File name:payload\skills\thorp-browser\scripts\browser_tools.py
File size:13'672 bytes
SHA256 hash: 6d844ff6f41be5ef08166c998a9ec9296f350cb1a942d87746938a7305a26e0e
MD5 hash: 1928a0f5b630b2edc75af716c0968ab8
MIME type:text/x-python
Signature RustyStealer
File name:payload\skills\thorp-browser\references\invisible-ui.md
File size:2'963 bytes
SHA256 hash: 0893e8080d71bcb6e5606fb0e8459fa75de60b3cf7324343e0000d43033785b5
MD5 hash: 473cd01e9f7a8519b22501626df1158f
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\scripts\browser_interact.py
File size:45'759 bytes
SHA256 hash: fda853c5be82bf224d5ff2f94453477ac2d3b910a22ffc29da26fc73b1df0576
MD5 hash: 00af5d01d373833bf8d81a81494cae1a
MIME type:text/x-python
Signature RustyStealer
File name:cloud-config.json
File size:343 bytes
SHA256 hash: b8f11ed49c960f0502da1d67a769f310480496b235a63d492ee8d298c7e9b036
MD5 hash: 64811de10503c59d7e4e1b4bfb4dcc5f
MIME type:application/json
Signature RustyStealer
File name:payload\skills\thorp-browser\scripts\thorp_browser_client.py
File size:26'566 bytes
SHA256 hash: 50e140ce979a5fd3cabe5c3ddd53ffcb2e660285a5c309f6f60609be1ffd7543
MD5 hash: 299f14f4fdacdb9c9e60fb01c54dccaa
MIME type:text/x-python
Signature RustyStealer
File name:Install-Thorp.ps1
File size:4'899 bytes
SHA256 hash: aa8f4a7dd38776daa34224bdab2b5438e47f5930145ea8c936df18c2252dc582
MD5 hash: 799507f4208d7e47f6d09f6fc088a638
MIME type:text/plain
Signature RustyStealer
File name:README.md
File size:5'296 bytes
SHA256 hash: afb55fabd1d17d250c29b4ddfb2c7edf366ba5c8682be9b1b3311cd468805d66
MD5 hash: 2796a891102736df6bea88fab4254e62
MIME type:text/plain
Signature RustyStealer
File name:payload\bin\thorp-agent-entry.exe
File size:292'352 bytes
SHA256 hash: a0eef13aa8894f1858c0b8635fdd081d5fd19749a4fdd66db5e6887038b8e500
MD5 hash: 83b1238549a63e19154e8af491000f39
MIME type:application/x-dosexec
Signature RustyStealer
File name:payload\version.json
File size:4'506 bytes
SHA256 hash: 86dea98c049960925e22ba8953ff6a93530d6c3f5947a4186561f9e8934e8bc2
MD5 hash: 02c757f88147e9e0358935c3701dc17f
MIME type:application/json
Signature RustyStealer
File name:payload\thorp-desktop.exe
File size:14'184'448 bytes
SHA256 hash: 4fb3ecb4376fcfa4f3b8ebda8a0f06d8c7cadbe489e3e00c3f66fab59b2a8b5c
MD5 hash: 32a744da80e978b4c037610b97ced02a
MIME type:application/x-dosexec
Signature RustyStealer
File name:payload\skills\thorp-browser\references\fingerprint-diagnosis.md
File size:8'134 bytes
SHA256 hash: 608191040d73a5fd215dda293d158de8211715e056b6006ef223d69e382047ce
MD5 hash: 9ef4cf890ca2168387a889309ebd13d6
MIME type:text/x-python
Signature RustyStealer
File name:payload\skills\thorp-browser\references\web-interaction.md
File size:10'308 bytes
SHA256 hash: 6afb88b7f8ecbd58da15fd0aa123aa53bdc543756318bcfdac58071e7269cb9e
MD5 hash: 6c5c261bfd077b8b7e77f22da883917e
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\scripts\project_environment_map.py
File size:9'842 bytes
SHA256 hash: 9f65537d66e29e138fc41f3e683666617b8918eb6b07a46aadb8f929aeb4c45e
MD5 hash: 317fbee47a0c1388d179f96d689ee486
MIME type:text/x-python
Signature RustyStealer
File name:payload\skills\thorp-browser\.gitattributes
File size:90 bytes
SHA256 hash: 336f62404634a818143f1df50deebb69a5bb0135b1636c19550d4fa133be202f
MD5 hash: 838a1ca611bc3786cbfa8a943440b703
MIME type:text/plain
Signature RustyStealer
File name:payload\bin\thorp.exe
File size:4'834'816 bytes
SHA256 hash: 14a456fec933d3475415d783d52cb2a447dae0b096c229ca3ed029136a43e163
MD5 hash: aab6ac336302b260717eca1185d60425
MIME type:application/x-dosexec
Signature RustyStealer
File name:payload\skills\thorp-browser\.gitignore
File size:167 bytes
SHA256 hash: a8f2a04c0046e960d1f91b43e40a0a143f71b2cf10482239c5f98feb6a06b3a8
MD5 hash: a849185f35bdf43e28406bc10d33ecdf
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\SKILL.md
File size:44'118 bytes
SHA256 hash: 118b911f2dd852a8a3c2df6819f68ce8769a81ffebe4adb96adf2b111c7b068f
MD5 hash: bdd47842beb8d609433dfad5d86dbd80
MIME type:text/plain
Signature RustyStealer
File name:payload\skills\thorp-browser\references\forms.md
File size:6'048 bytes
SHA256 hash: 63e5eed838f1c77759cad41ba2117029d8c4f51ce3f96da66b9a84aa32234c6e
MD5 hash: 3c60b3c35a8ce762c5ce5abb2439a39b
MIME type:text/plain
Signature RustyStealer
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c8f1d10c-6f1f-4398-90c4-83091c80527e/
Result
Verdict:
Malicious
File Type:
ZIP File
Link:
https://app.docguard.net/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3/results/dashboard
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3
Verdict:
Unknown
File Type:
zip
First seen:
2026-09-27T04:33:00Z UTC
Last seen:
2026-09-30T09:06:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3/results?tab=lookup
Score:
72%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3
Verdict:
Malware
YARA:
3 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1105 Zip Archive
Link:
https://app.malva.re/file/92538ed809c5b77e8582be4fedd307fd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgrxdqr5nozjqjm5ltiq7c6ynmlotevj3agba6tj5kta4k6hsorq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution linux trojan
Link:
https://tria.ge/reports/260930-na2w7asemg/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Executes a command shell one-liner
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_HTML_XMLHTTP_Redirect_Kit
Create hunting rule
Author:Marjoriefort
Description:HTML avec exfiltration XMLHTTP + redirection window.location - kit phishing frais
Reference:Veille fraicheur 2026-09-14 / cluster HTML
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Web_Generic_Binary_URL_Download
Create hunting rule
Author:Serhii Kocherhan
Description:Detects files containing HTTP or HTTPS links pointing directly to .bin payload extensions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

zip 51a371c23d6bb298259d5cd10f8bd86b16e992a9d80c107a69eaa60e2bc793a3

(this sample)

  
Delivery method
Distributed via web download

Comments