MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bfea7c0e2bc57ed3bfe5802377ca3c7545c11c39f13eafaac4fac69815fb63bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RustyStealer
Vendor detections: 8
| SHA256 hash: | bfea7c0e2bc57ed3bfe5802377ca3c7545c11c39f13eafaac4fac69815fb63bc |
|---|---|
| SHA3-384 hash: | 298cb05247a1543ccf7fba8c57a16cd04470a142ed3e70396c4489c1170c2455890fc82f2cc7141ed5d1ea082952703c |
| SHA1 hash: | d3433ca6fab5aecf1d76701cdc1d873e787fa567 |
| MD5 hash: | 09fa7ed361b397cd789e18708fc43247 |
| humanhash: | indigo-august-johnny-fruit |
| File name: | file |
| Download: | download sample |
| Signature | RustyStealer |
| File size: | 3'688'448 bytes |
| First seen: | 2026-07-24 08:05:13 UTC |
| Last seen: | 2026-07-24 08:10:16 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56720a0219cc1a5225b827e19e3be6e0 (4 x RustyStealer) |
| ssdeep | 98304:94pxZnh59Q0UrWMCIWscXHPYWuuau+DpyA+igfpawAAGuV1:mnfwfL+ou+V7lgfpprGu |
| TLSH | T1780623CC259C563CE08490740E12EAFF25697C951617E2B6B3A647392E8EF8ECD3DB14 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  Bitsight |
| Tags: | d52f85 dropped-by-amadey exe RustyStealer |
Intelligence
File Origin
# of uploads :
5
# of downloads :
139
Origin country :
USVendor Threat Intelligence
No detections
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Launching the process to interact with network services
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Setting a single autorun event
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug downloader loader packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Malware family:
sindresorhus-clipboard
Verdict:
Unknown
Score:
96%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Threat name:
Win64.Trojan.RustyStealer
Status:
Malicious
First seen:
2026-07-24 08:06:21 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 36 (41.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
defense_evasion execution persistence
Behaviour
NTFS ADS
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Obfuscated Files or Information: Command Obfuscation
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
bfea7c0e2bc57ed3bfe5802377ca3c7545c11c39f13eafaac4fac69815fb63bc
MD5 hash:
09fa7ed361b397cd789e18708fc43247
SHA1 hash:
d3433ca6fab5aecf1d76701cdc1d873e787fa567
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | detect_powershell |
|---|---|
| Author: | daniyyell |
| Description: | Detects suspicious PowerShell activity related to malware execution |
| Rule name: | Detect_Zoom_Invite_malware_RAT_C2 |
|---|---|
| Author: | daniyyell |
| Description: | Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2 |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | ProgramLanguage_Rust |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Rust programming language |
| Rule name: | Rustyloader_mem_loose |
|---|---|
| Author: | James_inthe_box |
| Description: | Corroded buerloader |
| Reference: | https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24 |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SUSP_Scheduled_Tasks_Create_From_Susp_Dir |
|---|---|
| Author: | SECUINFRA Falcon Team |
| Description: | Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.