MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RustyStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 15 File information Comments

SHA256 hash:	53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e
SHA3-384 hash:	6e8a7b38ff66dcd16f4b7bac3304cd9ecc98fe65c0979bf6846d1c7860c6f1b2029d8d77ce510236645c7d2505134725
SHA1 hash:	6badedb76852b79089cc16b276de18ab7f1bed3a
MD5 hash:	f798fd439f92f142312074b6cbf0288c
humanhash:	black-network-vegan-red
File name:	L4fOVO3.exe
Download:	download sample
Signature	RustyStealer Create hunting rule
File size:	3'725'312 bytes
First seen:	2025-09-17 18:03:02 UTC
Last seen:	2025-09-18 14:05:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b25557f316c563f336766cfbc5e9ece4 (6 x RustyStealer)
ssdeep	98304:w2c4m2HLfTeg3TEthSTgVuHuuR5TBk9ClGArTO/2L9aoj:n7rZEt4TgQ1TBk9qGoO/M9a
TLSH	T18A06236DF470EC6CEC1CD0B099EAA35DF5693889368368F393D891700E11AA5FB1C6D9
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	mazznrz
Tags:	exe RustyStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

0414afa428428418d32d9522b2ff1033e162761970c362602a80149df8f16f63.exe

Verdict:

Malicious activity

Analysis date:

2025-09-17 15:52:14 UTC

Tags:

lumma stealer auto redline amadey unlocker-eject tool arch-exec botnet loader telegram auto-startup themida autoit auto-sch rdp stealc vidar auto-reg gcleaner coinminer miner generic

Link:

https://app.any.run/tasks/9af7dc5f-7474-474e-a926-5682d6061291

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/27982/

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68caf80488b954439247588e

Tags:

obfuscate xtreme shell

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Launching the process to interact with network services

Launching a process

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Setting a single autorun event

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug crypt mingw packed

Link:

https://www.filescan.io/uploads/68caf80adbc6f5a29c4a47f3/reports/e0d2f54b-c7ad-4796-a630-9e792703d6bc/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-09-17T13:30:00Z UTC

Last seen:

2025-09-17T13:30:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Agent.xcaekt Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic VHO:Trojan-Downloader.Win32.Paph.gen

Link:

https://opentip.kaspersky.com/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f3311615-cbfb-47c9-8e3f-04023be7f764

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/f798fd439f92f142312074b6cbf0288c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e/

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e

Threat name:

Win64.Trojan.Injuke

Status:

Malicious

First seen:

2025-09-17 16:13:53 UTC

File Type:

PE+ (Exe)

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kpytoun6i7c65wlaiwm2jo7qcplha4se4wy5n6cguw4nhmfpwgpa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion execution persistence

Link:

https://tria.ge/reports/250917-wncs8aap5t/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Adds Run key to start application

Obfuscated Files or Information: Command Obfuscation

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/13155e5d-3871-41bb-9f03-9202f8e0db46

Unpacked files

SH256 hash:

53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e

MD5 hash:

f798fd439f92f142312074b6cbf0288c

SHA1 hash:

6badedb76852b79089cc16b276de18ab7f1bed3a

Link:

https://www.unpac.me/results/b9678850-9b4b-48eb-abb0-9c852dca7cb4/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/53f13751be47/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

troystealer

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/53f13751be47c5eed9604599a4bbf013d6707244e5b1d6f846a5b8d3b0afb19e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)