MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RustyStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df
SHA3-384 hash:	f5abceaf20ef5c63c9b84211c4ee05c7fc8b35e638e4a2fe9479760c5323d7846bc6d7f605071f5e6bbe06819cadfe2f
SHA1 hash:	541091b3d1dfa4fbfd7a1c03b3ebdc9abf07c07f
MD5 hash:	7e7193cc48c6de37a399218529246ea2
humanhash:	island-leopard-kansas-illinois
File name:	Launcher.exe
Download:	download sample
Signature	RustyStealer Create hunting rule
File size:	74'603'772 bytes
First seen:	2026-03-28 21:02:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7a5e2524b66da5177b4ec46d305a3dd7 (1 x WallStealer, 1 x ChromElevator, 1 x RustyStealer)
ssdeep	1572864:LswyBODMEgUINiCmpYmHIgVG1SF4JelKb2mk86MqadkLmX8MCE:L/yBCGbNxmKmHZVQrJe22k6MXqLra
TLSH	T145F733D9917502F3D3398F38D30808D6095BBE352A595DEB2AA6331B5503CDBBEB4C89
TrID	40.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.0% (.EXE) Win64 Executable (generic) (6522/11/2) 12.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.0% (.EXE) Win32 Executable (generic) (4504/4/1) 5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	86237371f1f1c937 (1 x RustyStealer)
Reporter	aachum
Tags:	193-222-99-18 exe fullsofts-org

iamaachum

https://fullsofts.org/

Loader C2:
http://193.222.99.18:3000/health
http://193.222.99.18:3000/report

Intelligence

File Origin

# of uploads :

# of downloads :

501

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

Launcher.exe

Verdict:

Suspicious activity

Analysis date:

2026-03-28 21:06:05 UTC

Tags:

nodejs

Link:

https://app.any.run/tasks/faa002e2-bfe2-458d-9d07-4aa4d5b86143

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c8421e635680513cf51bb4

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a window

Searching for synchronization primitives

Unauthorized injection to a recently created process

Running batch commands

Creating a process with a hidden window

Loading a suspicious library

Forced system process termination

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Connection attempt

Sending an HTTP GET request

DNS request

Sending an HTTP POST request

Adding an access-denied ACE

Launching a process

Creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

installer installer microsoft_visual_cc overlay packed

Link:

https://www.filescan.io/uploads/69c84214972c219c8d70cff2/reports/b6929842-c906-4b98-bd14-664fc15527de/overview

Verdict:

Suspicious

Labled as:

Malware/Generic

Link:

https://www.hybrid-analysis.com/sample/8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-03-29T22:44:00Z UTC

Last seen:

2026-03-29T22:57:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Agentb.tqmz

Link:

https://opentip.kaspersky.com/8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df/results?tab=lookup

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df

Gathering data

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-03-28 21:04:28 UTC

File Type:

PE (Exe)

Extracted files:

133

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qqj7nd5oxwqtxulkifmyhkvmlzruhlzf3tyh7fsqf5q5imns6tpq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260328-zv5z5aas6w/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in Windows directory

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/