MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0
SHA3-384 hash: 518a6e4ad2c6f7b5e38b0922a1298945589904d0e92208734efbc18886e44108ec15800af33a0897b48939a77f99cae2
SHA1 hash: b7a104e62f120f793015c78fefd1a5c4be11ec57
MD5 hash: 33c53fb37d5b19bc8de93dd975d00c7f
humanhash: sixteen-nineteen-lion-harry
File name:acrobat-update-service.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:396'288 bytes
First seen:2026-03-31 11:06:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 13148ba0b79ec7971d60872892734c78 (1 x RustyStealer)
ssdeep 6144:59vb4iX94WgxNfl0bh5rHOhMKpwp04vMwRaDRwLRlLOW:vbQanruap0BTc
Threatray 1 similar samples on MalwareBazaar
TLSH T17E844A11FB569CFCE066C474C25685636E3278DA0B22BDEF12D841393E6AAF16E3C714
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter smica83
Tags:exe HUN RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
HU HU
Vendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
_629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0.exe
Verdict:
Malicious activity
Analysis date:
2026-03-31 11:07:41 UTC
Tags:
donutloader loader rust
Link:
https://app.any.run/tasks/8963d453-b589-415a-95cb-ae2bb11998b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/59875/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cbaae33a18a6e1ddeffcb4
Tags:
virus shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Running batch commands
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd lolbin rust
Link:
https://www.filescan.io/uploads/69cbaae1e2df9aa488bfba72/reports/9d7372d4-e5a6-4dff-b32a-9d2d76ae5536/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-03-26T13:10:00Z UTC
Last seen:
2026-03-26T15:21:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Dedok.sb Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.sb Trojan.Win32.Pdfer.sba Backdoor.RABased.HTTP.C&C Trojan-Banker.Win32.ChePro.nlms Trojan-Banker.ChePro.HTTP.ServerRequest Trojan.Win64.Agentb.sb RemoteAdmin.NetSup.HTTP.C&C RemoteAdmin.NetSup.UDP.C&C
Link:
https://opentip.kaspersky.com/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3b346f17-82b7-4c21-90c2-3f82b9c0a332
Result
Threat name:
DonutLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1891362
Signature
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Unusual module load detection (module proxying)
Yara detected DonutLoader
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/33c53fb37d5b19bc8de93dd975d00c7f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-03-26 21:24:16 UTC
File Type:
PE+ (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mklzaujwa3sctfuzkzhylafthrpa7oiskbuv3zcdmt6es7s5hpia._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
7063f9bc5a6f8f7570d5176f15d570a7e0a69bf60725feebd1ce7d642e378004
RustyStealer
error
RustyStealer
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader adware discovery loader spyware
Link:
https://tria.ge/reports/260331-m73djshw7m/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Detects DonutLoader
DonutLoader
Donutloader family
Unpacked files
SH256 hash:
629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0
MD5 hash:
33c53fb37d5b19bc8de93dd975d00c7f
SHA1 hash:
b7a104e62f120f793015c78fefd1a5c4be11ec57
Link:
https://www.unpac.me/results/d83ef5d2-9f4b-4a99-9c84-2e1bbf1f0212/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/629790513606/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/629790513606e4299699564f8580b33c5e0fb91250695de44364fc497e5d3bd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/59875/

Comments