MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustDesk


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
SHA3-384 hash: 1c3bd78e6a44960341d59f62101498c20685a558d04206c6cd2aa01f4e35ed70eb316508533e363e8514ce7e17b31949
SHA1 hash: 824678b8f73c97b7bb5d423bd77584b26a86c27e
MD5 hash: 3b0bdf2503025c13f1c51036dab265c3
humanhash: golf-april-kilo-oregon
File name:8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
Download: download sample
Signature RustDesk
Create hunting rule
File size:2'885'119 bytes
First seen:2026-05-07 12:56:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 49152:ZAI+13b6ZlQ50RhSWTVvLgVOSVdh0SPIkzr6nnl46Se4C+8:ZAI+143RhSqMVffh6Y24E4Cd
TLSH T15ED52355E1C2D131D1424FF4CCA69269AD36FF4486F985C7E2F9BF08AB772A9180824F
TrID 94.7% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 8e9ab2aa9292aab4 (1 x Formbook, 1 x RustDesk, 1 x AndyDesk)
Reporter adrian__luca
Tags:exe rustdesk

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
GCleaner
Details
Link:
https://research.acce.ciphertechsolutions.com/results/87f1679e-3d55-4436-9f26-b60b60b08dce/
Malware family:
n/a
ID:
1
File name:
8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
Verdict:
Malicious activity
Analysis date:
2026-05-07 12:55:04 UTC
Tags:
pua adware github rustdesk rmm-tool remote
Link:
https://app.any.run/tasks/f38e1217-5de2-4171-b54b-572e0139f05c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/64759/
Detection(s):
SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Launching a process
Searching for synchronization primitives
Running batch commands
Creating a process with a hidden window
Moving a file to the %AppData% subdirectory
Creating a process from a recently created file
Searching for the window
Setting a global event handler
DNS request
Connection attempt
Sending an HTTP POST request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching a tool to kill processes
Loading a suspicious library
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 borland_delphi fingerprint installer installer installer-heuristic lolbin obfuscated overlay packed packed schtasks
Link:
https://www.filescan.io/uploads/69fc8c3d86e92bda7022c028/reports/b4418432-0be7-47d3-b87e-b1b299b3f1d8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-20T06:50:00Z UTC
Last seen:
2026-05-08T01:50:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic BSS:Trojan.Win32.Generic Trojan-Spy.Win32.Limpid.sb Trojan-PSW.Win32.Xploder.sb HEUR:Trojan.Win32.Config.gen not-a-virus:HEUR:Client-SMTP.Win32.Blat.gen
Link:
https://opentip.kaspersky.com/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2/results?tab=lookup
Malware family:
blat.net
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8ec37364-c65c-4358-ad53-010fd433842e
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
CAB:COMPRESSION:NONE Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/3b0bdf2503025c13f1c51036dab265c3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2/
Verdict:
Malicious
Threat:
Trojan-Spy.Win32.Limpid
Link:
https://tip.neiki.dev/file/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
Threat name:
Win32.Trojan.LibrarianGhouls
Create hunting rule
Status:
Malicious
First seen:
2026-04-23 01:44:49 UTC
File Type:
PE (Exe)
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rp4cf444yuzz3povfet7qn4afypzehgrazt2d4mia4ejzu4hlkza._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor defense_evasion discovery execution persistence privilege_escalation rat
Link:
https://tria.ge/reports/260507-p67mzsh17r/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies registry class
Modifies registry key
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Checks installed software on the system
Hide Artifacts: Hidden Window
Indicator Removal: Clear Persistence
Indicator Removal: File Deletion
Checks computer location settings
Creates new service(s)
Executes dropped EXE
Loads dropped DLL
Modifies service settings
RustDesk remote access tool
Stops running service(s)
Modifies Windows Firewall
Sets file to hidden
Unpacked files
SH256 hash:
8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2
MD5 hash:
3b0bdf2503025c13f1c51036dab265c3
SHA1 hash:
824678b8f73c97b7bb5d423bd77584b26a86c27e
Link:
https://www.unpac.me/results/3434e2aa-4be9-458e-b6a0-07ddead98247/
SH256 hash:
967ea1fee5276c7872712be48c92fbda1367a60020300f8b7e1f38eabb62efda
MD5 hash:
9c4d4c364eeeaedf3783f321377ca674
SHA1 hash:
14d62d9c4063429c7626c2047f1878083d8893fc
Link:
https://www.unpac.me/results/3434e2aa-4be9-458e-b6a0-07ddead98247/
SH256 hash:
d2487b5feffe15194614ecfd040cb36608969eea5808b71c284d60edb1b2b5d6
MD5 hash:
dba0fffb5f6776e5123082745c8f53ae
SHA1 hash:
2602bdcd77aa2a0a321df30e721e0445ae792b09
Link:
https://www.unpac.me/results/3434e2aa-4be9-458e-b6a0-07ddead98247/
SH256 hash:
3a24c341947f875e49762ccf40a5c907c53a6ac2a6cf5dcc463e3a7f985823c1
MD5 hash:
f3b949b29fe06d5eb051142f2c90f1a6
SHA1 hash:
be7b865b78578e9d7f165e4c8ad2bfbabe48fa8a
Link:
https://www.unpac.me/results/3434e2aa-4be9-458e-b6a0-07ddead98247/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bf822f39cc5339dbdd52927f837802e1f921cd10667a1f18807089cd3875ab2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/64759/

Comments