🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d
SHA3-384 hash: 5b44c4652386096b0822d12288d4990cb4f0d9c02c7e43f42b440aec27f56b21c0fffa377a5e9a81274bdb9e62b14913
SHA1 hash: dac5f73b7055a10926306fbadc03915cd10bab91
MD5 hash: 2543aa2ac997b8a589724a04f64b12f3
humanhash: bulldog-comet-venus-lake
File name:a76d4ca0f13aef19.bin
Download: download sample
Signature RustyStealer
Create hunting rule
File size:2'242'048 bytes
First seen:2026-10-31 03:25:13 UTC
Last seen:2026-10-31 04:16:58 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 603a12af845feb44eeaee4af0f3efa0b (13 x RustyStealer)
ssdeep 49152:Ayq6vhizXRpuk+XZDh5KyR7F/EeWwIU6istJ6:AyhQgJF8/P+s
TLSH T109A58E03E6E581ECC55AC078C3579673EA62B88D3920B6AF17D09B253E3AF509F0DB15
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Tuxxin
Tags:exe RustyStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
191
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-31 03:36:19 UTC
Tags:
ip-check stealer rustystealer auto-reg xor-url generic
Link:
https://app.any.run/tasks/efa8d395-b314-4120-8bae-7c3adcb465ec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96319/
Detection(s):
MiscreantPunch.SingleXOR.EXE.215.UNOFFICIAL
Create hunting rule

MiscreantPunch.SingleXOR.EXE.230.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae55fbbb121dd519dcefec7
Tags:
malware
Verdict:
Malicious
Labled as:
Win64_HackTool_PSWDump_AGen_CM_trojan
Link:
https://www.hybrid-analysis.com/sample/a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d
Verdict:
Unknown
File Type:
exe x64
First seen:
2026-10-31T00:36:00Z UTC
Last seen:
2026-11-01T01:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d2134bf3-5db6-40eb-b974-47bcfa1c2788
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1995695
Signature
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Uses ipconfig to lookup or modify the Windows network settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995695 Sample: a76d4ca0f13aef19.bin.exe Startdate: 31/10/2026 Architecture: WINDOWS Score: 64 55 api.ipify.org 2->55 65 Multi AV Scanner detection for submitted file 2->65 67 Joe Sandbox ML detected suspicious sample 2->67 8 a76d4ca0f13aef19.bin.exe 2 2->8         started        12 a76d4ca0f13aef19.bin.exe 2->12         started        14 a76d4ca0f13aef19.bin.exe 1 2->14         started        16 12 other processes 2->16 signatures3 process4 dnsIp5 57 176.65.144.144, 80 DEDIK-CHGB Switzerland 8->57 59 api.ipify.org 172.67.74.152, 443, 49703, 49708 CLOUDFLARENET-CloudflareIncUS Canada 8->59 69 Creates multiple autostart registry keys 8->69 18 cmd.exe 1 8->18         started        21 cmd.exe 8->21         started        31 2 other processes 8->31 71 Found direct / indirect Syscall (likely to bypass EDR) 12->71 23 cmd.exe 12->23         started        25 cmd.exe 14->25         started        33 2 other processes 14->33 61 104.26.12.205, 443, 49763, 49770 CLOUDFLARENET-CloudflareIncUS Canada 16->61 27 cmd.exe 1 16->27         started        29 cmd.exe 16->29         started        35 23 other processes 16->35 signatures6 process7 signatures8 63 Uses ipconfig to lookup or modify the Windows network settings 18->63 37 conhost.exe 18->37         started        39 ipconfig.exe 1 18->39         started        41 2 other processes 21->41 43 2 other processes 25->43 45 2 other processes 27->45 47 2 other processes 29->47 49 3 other processes 31->49 51 4 other processes 33->51 53 33 other processes 35->53 process9
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/2543aa2ac997b8a589724a04f64b12f3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d/
Threat name:
Win64.Trojan.Convagent
Create hunting rule
Status:
Malicious
First seen:
2026-10-25 16:04:27 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5wuzihrhlxrtnrbotlol6ulrjapohythtzksnzxchm7jqgl7cgq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261031-dywd7stxc1/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Adds Run key to start application
Looks up external IP address via web service
Unpacked files
SH256 hash:
a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d
MD5 hash:
2543aa2ac997b8a589724a04f64b12f3
SHA1 hash:
dac5f73b7055a10926306fbadc03915cd10bab91
Detections:
SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Link:
https://www.unpac.me/results/b61a16e3-c7a2-4c43-b5d4-e2ad550204b4/
SH256 hash:
6d12639d9b06023d7ed5c180a0ed87b4b334d22bc56ff381b0e0dac82339b31f
MD5 hash:
d5b5eb8596ddca773ac56dfc6d9499f9
SHA1 hash:
2540b96c0919ca45617cf3d28c7be10ffecbdf24
Link:
https://www.unpac.me/results/b61a16e3-c7a2-4c43-b5d4-e2ad550204b4/
SH256 hash:
37b3428b9cc767bca5fa36d7e2825fc43e6c4bdfa14b43e3c60dd0e66fd01e5a
MD5 hash:
f641db7b4d62078984cfd2f832fd7574
SHA1 hash:
53157fe905402da313753c2ff7a023bd4621ad10
Link:
https://www.unpac.me/results/b61a16e3-c7a2-4c43-b5d4-e2ad550204b4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe a76d4ca0f13aef19b62174d6e5fa8b8a40f71f133cf2a9373711d9f4c0cbf88d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/96319/

Comments