MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651
SHA3-384 hash: 091aaf1198948d71b0a7065e3bfee705ccd0b7e50a210978961de4feb9d13b669c389e8fa49fe3d3ffe29f90f1290536
SHA1 hash: 45714cf92b5820ca115568d8f4ea48293dcc66b6
MD5 hash: 91874b34526a38f9ca0727f323c3188a
humanhash: juliet-lithium-beer-item
File name:updated_enc.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:1'709'056 bytes
First seen:2025-12-06 17:31:33 UTC
Last seen:2025-12-06 19:32:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a0d042903cdca7ad69043e384147e80a (9 x RustyStealer)
ssdeep 24576:fYnOMEeCG6p7rkwOmb0/GSybRvXmptDZ17J5nqjGI8Z7/l7:fYnOMhCG6tM/GSybJov7J5nqjGI8Z7
TLSH T10C857E07F2A581EDC09EC1B48346AA33BA36B8890621B9BF17D55B703E66F514F1E70D
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter juroots
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
updated_enc.exe
Verdict:
No threats detected
Analysis date:
2025-12-06 17:39:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eab6e0c8-0bec-4038-b1f9-eb89fe4066da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42822/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.45337622.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69346993c61465c74cbc0605
Tags:
virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-06T15:14:00Z UTC
Last seen:
2025-12-07T15:56:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Ransom.Win64.Agent.gen
Link:
https://opentip.kaspersky.com/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d13343fe-94e7-466a-91cc-080b12e7bd22
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/91874b34526a38f9ca0727f323c3188a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651/
Verdict:
Malicious
Threat:
Trojan-Ransom.Win64.Agent
Link:
https://tip.neiki.dev/file/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-06 15:01:07 UTC
File Type:
PE+ (Exe)
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttzhgendt5erl3y6unxrae4bysz3p7qo52sdvfzz34k4a2swgziq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251206-v55d5a1jb1/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9c6a2150-6c64-4046-8acd-7e1902631aff
Unpacked files
SH256 hash:
9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651
MD5 hash:
91874b34526a38f9ca0727f323c3188a
SHA1 hash:
45714cf92b5820ca115568d8f4ea48293dcc66b6
Link:
https://www.unpac.me/results/6c502fe4-2f82-448d-87bd-c7d8b897e959/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/42822/
  
URLhaus
https://urlhaus.abuse.ch/url/3727776/
  
Delivery method
Distributed via web download

Comments