MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RustyStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 9 File information Comments

SHA256 hash:	b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3
SHA3-384 hash:	4f955334825b3c995c6b19cbe0f7d83488a2e588c9410c7c4c4190c28c01984c327fc3b4e5f59d0ad05cbc6ed160c65a
SHA1 hash:	01a47be77a8fca8990b30411cdbe8175b4b5c130
MD5 hash:	3d274f5da6f4691ff4684f6278027fef
humanhash:	five-minnesota-ink-white
File name:	b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3.exe
Download:	download sample
Signature	RustyStealer Create hunting rule
File size:	32'390'144 bytes
First seen:	2026-10-12 07:25:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	0bc1b1e557f4a4387777840b7c7925ef (11 x RustyStealer, 1 x NWHStealer)
ssdeep	393216:G58k/JcIMpSiEcNJECDECs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:u8k/jAICahDLBtVbD1DT9SfhMhz
TLSH	T199670168024CE388745F4635F394FC3FF2E8359A7376E8A9BC3991DA64522C2C279587
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	exe RustyStealer

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

s2.rar

Verdict:

Malicious activity

Analysis date:

2026-10-09 16:44:51 UTC

Tags:

auto metasploit framework arch-exec arch-scr github opendir lumma stealer rustystealer python generic loader telegram v20-stealer cyberstrikeai backdoor pastebin brat stealc pyinstaller nemucod evasion possible-phishing phorpiex botnet powershell xmrig miner svc remusstealer solaris dsys rat tinynuke ip-check phishing remcos cobaltstrike tool susp-powershell clickfix xworm reversessh coinminer adware silentnet openssl archive vidar santastealer cryptolocker ransomware datto rmm-tool screenconnect advancedinstaller cryptowall wannacry gh0st networm amus dcagentrmm remote websocket r77rootkit rootkit amadey whitesnake discord acr action1rmm hijackloader redline meterpreter whitesnakestealer koiloader discordrat azorult quasar

Link:

https://app.any.run/tasks/d39d8222-d6ac-4a72-8886-83781795537f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Reading critical registry keys

DNS request

Creating a window

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file in the Program Files subdirectories

Connection attempt

Unauthorized injection to a recently created process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

ai-born anti-debug installer-heuristic llm-interaction packed

Link:

https://www.filescan.io/uploads/6acc8b62667750ef6ccaac48/reports/fc136203-c9be-4102-9a74-956d8fc2ed2a/overview

Verdict:

Malicious

Labled as:

Whisperer.1.Generic

Link:

https://www.hybrid-analysis.com/sample/b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-08T03:39:00Z UTC

Last seen:

2026-10-12T06:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1985728

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found direct / indirect Syscall (likely to bypass EDR)

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3

Gathering data

Threat name:

Win64.Trojan.Whisperer

Status:

Malicious

First seen:

2026-10-08 09:21:54 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xc445vae4cks3u5vwrj33uuq6vtg2vklmmjpf47b44by5nlzaczq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/261012-h84wjshd67/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

exe b8b9ced404e0952dd3b5b453bdd290f5666d554b6312f2f3e1e7038eb57900b3

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3945788/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample