MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff
SHA3-384 hash: 8b1fd913434aa642f4f4effb0a1cf6e8232c49bc6dcff666bbcaac45a46d44b1ecea970a7509b733f4b0b2a25518e00b
SHA1 hash: d7c17d77c8eb9b1bba325dd7810a74e3b3d260c0
MD5 hash: b9d18df723bd19f7b876f5327f2db7a0
humanhash: undress-uniform-kitten-jupiter
File name:load.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:302'080 bytes
First seen:2023-09-18 06:40:04 UTC
Last seen:2023-09-18 07:41:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0e859ad74823b59c8c94d4099909130c (1 x RustyStealer)
ssdeep 6144:bBpfLHAmppMQoqeek0OLR2XHtR0JEJjSQlIQL:bLAMK3qC0OLRwn0asQiq
Threatray 13 similar samples on MalwareBazaar
TLSH T19854AD16F74260FDD45BC0B8824655227972BCC81B31AEFF2694723A7D77AF02E38648
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter JAMESWT_WT
Tags:159-69-11-30-8080 exe RustyStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
load.exe
Verdict:
No threats detected
Analysis date:
2023-09-18 11:19:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/42787934-8fdc-40fd-9f98-8bd5dca2f966

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449254/
Detection(s):
SecuriteInfo.com.Win64.InjectorX-gen.2611.2358.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/6507f0ff83a0c6425df80d7c/reports/4a2fdf76-3eaa-4a25-a427-d7251e0e3583/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4dc8b687-91c2-41a7-b0c8-efd363b527e0
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1309800
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1309800 Sample: load.exe Startdate: 18/09/2023 Architecture: WINDOWS Score: 84 17 Found malware configuration 2->17 19 Malicious sample detected (through community Yara rule) 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 4 other signatures 2->23 6 load.exe 3 2->6         started        process3 dnsIp4 15 159.69.11.30, 49706, 7000 HETZNER-ASDE Germany 6->15 9 WerFault.exe 20 9 6->9         started        11 conhost.exe 6->11         started        13 notepad.exe 6->13         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff/
Threat name:
Win64.Spyware.Rustystealer
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 06:37:53 UTC
File Type:
PE+ (Exe)
AV detection:
14 of 23 (60.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=swigt7wnxvbup3ctogpqnkfkwlky2kwreejj47pfsuat2uvffl7q._file
Verdict:
malicious
Similar samples:
24b2739b4e61c486554efb03e491cff9bde52b5f6bcf785c7784ab77fef9d0b2
RustyStealer
68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037
RustyStealer
876c3656f74c6fcfaa25bda37dc1c6f868677c088953c722ef4595efe40f0c7f
RustyStealer
916ea8bc5735dae25ea4df4eadba0da4f85fdaeaf99dd6f7210e44ee594425e2
RustyStealer
a21c2b6912772143895aa9ac106b3d0f31dee43fb8167c43f8f54aafda5783a3
RustyStealer
b4717d4c65dc8d69d33ac0dc7d3f7608637a420cd3454f4eec0a2238d83327d4
RustyStealer
d6fcf0bcebcac7aa5e7b21b189dbd89f314f79871b770911a7d7b780207fb83d
RustyStealer
+ 3 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm rat trojan
Link:
https://tria.ge/reports/230918-hfrqhsaa79/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detect Xworm Payload
Xworm
Malware Config
C2 Extraction:
159.69.11.30:7000
Unpacked files
SH256 hash:
959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff
MD5 hash:
b9d18df723bd19f7b876f5327f2db7a0
SHA1 hash:
d7c17d77c8eb9b1bba325dd7810a74e3b3d260c0
Link:
https://www.unpac.me/results/ac21068b-c91c-4f17-9c8f-99bc6357e1d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/449254/

Comments