MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
SHA3-384 hash: 16738a4765c139d50ee9edf7e83662a5aa34272515bd6c0ef78e200936b0d2da5eae185552372b2460b7758502bad525
SHA1 hash: 5e9cda4862dd187019c01a42eff1c17566ca8f71
MD5 hash: 23f6cd4aa78a9cc6e85536acbed9b507
humanhash: fourteen-twelve-minnesota-magazine
File name:fixed_enc.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:1'950'208 bytes
First seen:2025-12-06 17:30:14 UTC
Last seen:2025-12-07 10:35:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2583461d88c56e13c224ccdd0e0d33ac (1 x RustyStealer)
ssdeep 49152:e2QC16k/gMfa5Um4RmOAGcCBTh7+9i8E2w:oMfa5Um4RrhQm2
Threatray 25 similar samples on MalwareBazaar
TLSH T114958D03F2A6D1EDC09EC1B443469A32BA7AB889162579FF06E15B312E65F510F0FB1D
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter juroots
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
76
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e.exe
Verdict:
Malicious activity
Analysis date:
2025-12-06 18:08:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7651bb9e-0198-4711-8c11-eff4d506cd0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42792/
Detection(s):
SecuriteInfo.com.Trojan.Win32.DelShad.pbd.19430.9286.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693468f6920336450abc0793
Tags:
spawn sage remo
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm expand explorer fingerprint lolbin mingw packed schtasks
Link:
https://www.filescan.io/uploads/69346882bba50eaf042472af/reports/85bd324b-380f-4e82-9ec0-85499b63f6c6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-06T15:37:00Z UTC
Last seen:
2025-12-07T01:41:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.DelShad.sb Trojan.Win32.DelShad.pbd Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Trojan.Win64.Agent.sb
Link:
https://opentip.kaspersky.com/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/651c2003-7243-486f-84da-e4663af4cf93
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/23f6cd4aa78a9cc6e85536acbed9b507
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e/
Verdict:
Malicious
Threat:
CloudSandbox.Malware.Generic
Link:
https://tip.neiki.dev/file/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rafkkq7o3omii7sdixqcjsprmzpczhptyn46zqmns5r2i3ifwr7a._file
Verdict:
malicious
Label(s):
genericransomware
Create hunting rule
Similar samples:
1b5d23c3b3a12bfff4b8b2f1f1e3c057b31c7b9a1c9252ac5f61d16ef93dee39
RustyStealer
309bd7b7aa737ede834e498e177a9e0b44b4b46a8666b8182ddc0a4aa283494a
RustyStealer
4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518
RustyStealer
880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
RustyStealer
90d223b70448d68f7f48397df6a9e57de3a6b389d5d8dc0896be633ca95720f2
RustyStealer
93c53ebc8d1ee19dad41cfb7989ed047136cd80669ec8ba7b0af4016f9123cc1
RustyStealer
d942896e56eb6dc83c8788c92e6fe7c57ee419b9b092f3089c74b3f0e181b154
RustyStealer
error
RustyStealer
+ 15 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion execution impact ransomware
Link:
https://tria.ge/reports/251206-v4mspazrf1/
Behaviour
Modifies registry class
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates system info in registry
Interacts with shadow copies
Kills process with taskkill
Enumerates physical storage devices
Enumerates connected drives
Checks computer location settings
Deletes shadow copies
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fcfd329b-b728-4604-8e08-649c3d2b82d2
Unpacked files
SH256 hash:
880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e
MD5 hash:
23f6cd4aa78a9cc6e85536acbed9b507
SHA1 hash:
5e9cda4862dd187019c01a42eff1c17566ca8f71
Link:
https://www.unpac.me/results/88de4469-39f8-4d29-b682-b1b2636ec82f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/880aa543eedb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/42792/
  
URLhaus
https://urlhaus.abuse.ch/url/3727781/
  
Delivery method
Distributed via web download

Comments