MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92
SHA3-384 hash: 49e3ae0d8102a54561cb823c6806fb6484617ce1b932c9b97e7a578250376906b5cf703d365a02e821b5d0e393dca59c
SHA1 hash: 84764b41c87b9f02e680cd4fe800f9597ddadd59
MD5 hash: d8dfab4fe38c31c0f673c3e96672c65f
humanhash: magazine-nineteen-pip-floor
File name:IL_Beta.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:3'104'768 bytes
First seen:2022-10-08 02:22:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a528f3afc13a1f11b481ad804b583a01 (1 x RustyStealer)
ssdeep 49152:ILonJif7tAodaOm53wOD9aQHwGRP26r9+OXpFl6JEGmBYFpO6qmyAJhH:IV6z53a4SzRxDJ
TLSH T162E58C47F3A445EAC46BC139D6079623FB71BC890721B79B1BE456622F23BA01F2E315
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter LethalAspect
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IL_Beta.exe
Verdict:
No threats detected
Analysis date:
2022-10-08 04:47:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c44fdcf1-c19f-4c3e-b770-10d417a9d714

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/317798/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62502262.23722.1328.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm
Link:
https://www.filescan.io/uploads/6340df0649c58ce767c6969b/reports/6ba80dca-d7e3-467b-910b-65929737410d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2eb74ff2-69c8-46a9-b50e-cc838c048ef0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1086139
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92/
Threat name:
Win64.Infostealer.Discord
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 23:33:17 UTC
File Type:
PE+ (Exe)
AV detection:
12 of 41 (29.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkoini5gihhl2j2womy2xayfqj6lpgwluwji5dhajt36kxuex6ja._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221008-ct5awaeaa4/
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1646fd5a-75c1-474a-a1f2-44e16bebd492
Unpacked files
SH256 hash:
529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92
MD5 hash:
d8dfab4fe38c31c0f673c3e96672c65f
SHA1 hash:
84764b41c87b9f02e680cd4fe800f9597ddadd59
Link:
https://www.unpac.me/results/05197dcb-ed1c-4d50-a4b2-1e8bca90b5ca/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/529c86a3a641/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/317798/

Comments