MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e
SHA3-384 hash: 8750a2ccfe5f754e59c22718efa922bc8285f2ddef786d5a95ae15774d983354aef1166c31eecfd76f5d2f1bf6f1705d
SHA1 hash: a923c30e4b3ea331185eb727bf5e39115dae0f11
MD5 hash: 9114eac4eb34599997e5fa59bf64f1ef
humanhash: venus-jersey-sink-golf
File name:a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:166'400 bytes
First seen:2023-07-02 05:14:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7883812760f6326a5bfd68c807758f9c (1 x RustyStealer)
ssdeep 3072:g2NEk99HV9xgMFHgFFuqduAM8TqPYwrP2:gUR9xFOMTYkP
Threatray 293 similar samples on MalwareBazaar
TLSH T157F36B23B64560FDD82BC1B4825256727A767C880F217EFF06A872351E39AE07E3DA54
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter obfusor
Tags:CobaltStrike exe RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
HK HK
Vendor Threat Intelligence
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/405106/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/94709/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/64a107d7cf99e7a5cfcc71ca/reports/ced46e3c-0235-413f-a307-a1dbabddd5da/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23041b81-b43b-4402-ba9d-04d41b7eac18
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1264869
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e/
Threat name:
Win64.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2023-07-02 05:15:05 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg43aqobkjj4u4acsweirfrhh7ly7n7mdnnmqtk6tbfzmfoj3rha._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0461700051e86d2c7bb96b3151db07507a6cb7c05d235e39b001823f70f8b130
RustyStealer
080c2647fb26ac8576014a21591465eba5b0ee03475f70e95bc3a4caa8d3642e
RustyStealer
6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829
RustyStealer
8344424b2ab65b90171d02df7f9f8625308284c4b25e0e489c005f9c164784c2
RustyStealer
864c5339ddc1ad5df17d454c023d0f34a2bfebe76a19314f552d72123a845863
RustyStealer
da745a98fcd59b61e6365661a809bc8abf2c029863cd6ade3c4ccb2115cd0ee2
RustyStealer
e292bf04e0c03341436ab4411ddde881129db4904ae2234952f3a655f14d5cb7
RustyStealer
e8da0c4416f4353aad4620b5a83ff84d6d8b9b8a748fdbe96d8a4d02a4a1a03c
RustyStealer
ef14393974b607435db89dcd21cbfeb50d14988fec8570cf13b2dbfbd719e062
RustyStealer
+ 283 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1359593325 backdoor trojan
Link:
https://tria.ge/reports/230702-fxj1wsbg9t/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://service-0hf6dzvz-1317000763.sh.apigw.tencentcs.com:80/bootstrap-2.min.js
http://service-0hf6dzvz-1317000763.sh.apigw.tencentcs.com:80/api/x
Unpacked files
SH256 hash:
a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e
MD5 hash:
9114eac4eb34599997e5fa59bf64f1ef
SHA1 hash:
a923c30e4b3ea331185eb727bf5e39115dae0f11
Link:
https://www.unpac.me/results/62a28e96-9c64-48c2-85ac-b4da8cf3970a/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a9b9b041c152/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9b9b041c15253ca700295888896273fd78fb7ec1b5ac84d5e984b9615c9dc4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/405106/

Comments