MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 9 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d
SHA3-384 hash: 62cc0227f9574391fe20eeb1254a23af933ff4d653892d8acae03453ea627dd9382e44e08e5eca255f9ec168ee44017f
SHA1 hash: b3f79a411a1f059af2da3de1193f004373aa1f70
MD5 hash: 026d5ab6f52d8336177c11dcaf9d9d16
humanhash: pennsylvania-oven-river-mockingbird
File name:mgm202589670875i456u356235734742256869909145454ki953323467578676097.scr
Download: download sample
Signature RustyStealer
Create hunting rule
File size:928'544 bytes
First seen:2025-04-12 12:04:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b8515ad185c42a95138b31712c88c85c (1 x RustyStealer)
ssdeep 12288:bPhRg+rXsEIrQPgdgpG+X1v9EoEY9LUCdiy3yeD4+ZM5mRMMTcbl:bP/g+rXsEIrQIdy1v9XruQMWTil
Threatray 40 similar samples on MalwareBazaar
TLSH T11B15BF25FA4968EDC05AC0B5C645E662393576CB0B3868FF11F5A1343E79AF12E3CE09
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 336b1737373f3f37 (5 x DCRat, 4 x GurcuStealer, 1 x RedLineStealer)
Reporter kafan_shengui
Tags:CobaltStrike exe RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
549
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
cobaltstrike
Create hunting rule
ID:
1
File name:
mgm202589670875i456u356235734742256869909145454ki953323467578676097.scr
Verdict:
Malicious activity
Analysis date:
2025-04-12 07:56:59 UTC
Tags:
evasion cobaltstrike xor-url generic
Link:
https://app.any.run/tasks/b13a27e3-fd4e-463b-9ae7-817baa5e96b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/1979/
Detection(s):
Win.Loader.TetraLoader-10042731-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67fa62f01dba888a93d19a2b
Tags:
cobaltstrike emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Connection attempt
Sending an HTTP GET request
Running batch commands
Sending a custom TCP request
Сreating synchronization primitives
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd expired-cert fingerprint invalid-signature lolbin masquerade microsoft_visual_cc rust signed
Link:
https://www.filescan.io/uploads/67fa570240adfb5162c0b27a/reports/d1943500-a2d7-4e2b-9551-fee8b9475f76/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/340c9c2d-99fa-4ed1-bd96-8227b068bdef
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1663772
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1663772 Sample: mgm202589670875i456u3562357... Startdate: 12/04/2025 Architecture: WINDOWS Score: 100 25 apistudio.xyz 2->25 27 ip.sb 2->27 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus detection for URL or domain 2->39 43 3 other signatures 2->43 8 mgm202589670875i456u356235734742256869909145454ki953323467578676097.scr.exe 1 2->8         started        signatures3 41 Performs DNS queries to domains with low reputation 25->41 process4 dnsIp5 29 apistudio.xyz 104.21.9.149, 2096, 49716, 49717 CLOUDFLARENETUS United States 8->29 45 Found direct / indirect Syscall (likely to bypass EDR) 8->45 12 curl.exe 1 8->12         started        15 cmd.exe 3 2 8->15         started        17 notepad.exe 8->17         started        signatures6 process7 dnsIp8 31 ip.sb 104.26.13.31, 49714, 80 CLOUDFLARENETUS United States 12->31 33 127.0.0.1 unknown unknown 12->33 19 conhost.exe 12->19         started        21 notepad.exe 15->21         started        23 conhost.exe 15->23         started        process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d/
Threat name:
Win64.Backdoor.Cobeacon
Create hunting rule
Status:
Malicious
First seen:
2025-04-12 12:05:18 UTC
File Type:
PE+ (Exe)
Extracted files:
15
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pef6rgebnizxiwrlggyuvlz2q5wwd7gfz5mhg2ghlfrf6et52ggq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1bcdd9648584644da843486719f16b20250d3ca1015a6996085b43135d67615b
RustyStealer
3625fddc2687c086d6d4a4300b03d4a2492acf8e843697f57830bb40956f495a
RustyStealer
4a3341b1a681826f08bc9ec90ca24459826bb28f909030ba522d5ae2c92467d7
RustyStealer
517b6b3e890f7b93e0006cd8486b778075ebcc647565d37f2186500a8ddc1ff7
RustyStealer
790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d
RustyStealer
7a4933b2681d0ac28689c0a33e1b2ab5edccee89b014ae222465ccc29e2b293e
RustyStealer
899c529454c4286185a9d3c039277ce28957590e7ed3e586ccf1487317159c22
RustyStealer
d49c2451497109ae9f2646d06aa6dcf51b0f6af825d07f516b8dd59c03602401
RustyStealer
e1b6bd9876ca534e99b28403661e09b7a1ab7dac706df3962a0c975ba5b9e8ec
RustyStealer
error
RustyStealer
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/250412-n9a8hstqz5/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Verdict:
Malicious
Tags:
Win.Loader.TetraLoader-10042731-0
YARA:
n/a
Link:
https://app.threat.zone/submission/787a1799-e220-41c9-b9eb-edbf147b14ad
Unpacked files
SH256 hash:
790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d
MD5 hash:
026d5ab6f52d8336177c11dcaf9d9d16
SHA1 hash:
b3f79a411a1f059af2da3de1193f004373aa1f70
Link:
https://www.unpac.me/results/1908d4c9-b94f-41c1-9b56-eb03fa0dd407/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/790be898816a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/1979/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CreateProcessW
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
ntdll.dll::NtCreateThreadEx
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetSystemDirectoryW
KERNEL32.dll::GetFileAttributesW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptGenRandom
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW

Comments


Avatar
commented on 2025-04-12 12:05:33 UTC

C&C:apistudio.xyz
Source:205.185.114.254? (Form SSL Certs on IP)