MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06
SHA3-384 hash: 2eadc759bc6a4e8b6253df2e71ea1d02b87aee15be0b1505af57b9ab271dd0b90d71378252b9d516b77c230953243674
SHA1 hash: 1b159b89939765fc9154131623417dc507701042
MD5 hash: 8065e99bad5ca445cc93fb51511f28a2
humanhash: ten-nitrogen-avocado-mobile
File name:8065e99bad5ca445cc93fb51511f28a2
Download: download sample
Signature RustyStealer
Create hunting rule
File size:300'544 bytes
First seen:2021-09-30 20:19:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 85876006c2ecd2e9a446192cb4f7518c (3 x RustyStealer)
ssdeep 6144:hjzXhUDN1sGcVwkBCX+6i4HG9LcZ83jCIdTNVKk:hjjhw1svcX+6i4+
Threatray 1 similar samples on MalwareBazaar
TLSH T1E8544B07E28554F8D06EC1B887965572FB72BC450725BAEF2BE036212E22FD0AF2D745
Reporter zbetcheckin
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8065e99bad5ca445cc93fb51511f28a2
Verdict:
No threats detected
Analysis date:
2021-09-30 20:49:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f9be79f2-c85a-4926-9b08-7b8ce71d59cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193789/
Detection(s):
SecuriteInfo.com.Win64.ClipBanker.Z.23252.16116.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win64.ClipBanker.Z.10926.7217.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3353c282-627b-4d62-8118-73384bac8ff0
Result
Threat name:
MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/862296
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06/
Threat name:
Win64.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 17:14:21 UTC
AV detection:
9 of 27 (33.33%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2956aa1ab9cc6636e5a65247e4f430a856c51a93d6466607e1c9715cacba699e
RustyStealer
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210930-y4envsadf3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Drops startup file
Unpacked files
SH256 hash:
8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06
MD5 hash:
8065e99bad5ca445cc93fb51511f28a2
SHA1 hash:
1b159b89939765fc9154131623417dc507701042
Link:
https://www.unpac.me/results/f0836640-1465-48b2-98b8-7c2d70c301a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 8072b59731f897542f7999d2a9aaa92abc576d364179d057672ec8222afefe06

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193789/
  
URLhaus
https://urlhaus.abuse.ch/url/1649493/

Comments


Avatar
zbet commented on 2021-09-30 20:19:35 UTC

url : hxxps://www.emetincelle.com/RuntimeBroker.exe