MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
SHA3-384 hash: 83cbd4883a523d078401e01e6dbfa0eb4ee4a0c10ff525f9ffa40386de96319ce01e1e23a2b475de912a8a2a4ee0b57b
SHA1 hash: cea752f898cf77bd63d7ed21815746e7abf615b6
MD5 hash: 720804a1e38299c4ffa1e67a966c8e74
humanhash: fourteen-vegan-lima-snake
File name:file
Download: download sample
Signature RustyStealer
Create hunting rule
File size:571'043 bytes
First seen:2025-12-03 15:27:47 UTC
Last seen:2025-12-03 15:30:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4d0baad4973da8341e14b651526cb4db (1 x RustyStealer)
ssdeep 6144:98QWm3cB4z1ehvGivs8KU54R+14pxyvOIDOSBrXzsiXsxcoactl+mp/cMoZU:9jyQi0K4pxIvlX8VZnBcMoZU
Threatray 111 similar samples on MalwareBazaar
TLSH T10EC49E97F1A26DB8D227C0388217F17B7A3A75852522BF775AA4C9306F62FC12F09705
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 RustyStealer


Avatar
Bitsight
url: http://178.16.55.189/files/8167064937/MY33fR4.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-03 15:28:17 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/8026753e-7f46-48f6-a654-c718c53ff5e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42319/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6930571216e6db515e465568
Tags:
ransomware virus crypt
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
Result
Gathering data
Verdict:
Clean
File Type:
exe x64
Link:
https://opentip.kaspersky.com/c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/33649c2a-7500-4cfa-8c95-3a0ef0724dae
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe/
Verdict:
Malicious
Threat:
Family.MASKGRAM_STEALER
Link:
https://tip.neiki.dev/file/c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ywzldegrr5aakhcws52gwijfftyurff2ccxg4pqapzxv5vftdx7a._file
Verdict:
malicious
Label(s):
maskgramstealer
Create hunting rule
Similar samples:
0a04210eaf96a610c6b570186e42cdaa70082bfeec187a8d7fbc0ee1a3f937f1
RustyStealer
1be9782fe01bc1ec26e9b6740841214ef708f6e02b6705b078aafc3dc35679d0
RustyStealer
2c8552ce73d9c383418a8f6f597a26ce5c7e0d6176aa8c36fd417af234dc3fdc
RustyStealer
4b6426609af09c79368ff80f342017e89722353a2998378fbac0fb88af32b3c3
RustyStealer
540c3a52fee60aaea28abc5b11a5327d8ef435d425ddbec13e0adc1afd027b2f
RustyStealer
8d2345c7d51b83b80873e9ef69fccc3570e811ad8d9b8415f1f575e140b507cb
RustyStealer
a9ddcfbfd2cb226daf2198e34ff67e64ce2f83e7c4e15e5025e979004b5aa8ec
RustyStealer
cb0e0959ecacb57fed317d11be23b89f461a83d08270510f7a2c925589268953
RustyStealer
error
RustyStealer
f9929c5bb18eddbaec3c625a83745ff94459b5878eb5ced09fe372014f7b169d
RustyStealer
fdae212f90cc7296bf4bae2b265a093ca98ef5caa0034a0db063d17084e22da3
RustyStealer
+ 101 additional samples on MalwareBazaar
Result
Malware family:
maskgram_stealer
Create hunting rule
Score:
  10/10
Tags:
family:maskgram_stealer spyware stealer
Link:
https://tria.ge/reports/251203-swfnaszrew/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Detects MaskGramStealer payload
MaskGramStealer
Maskgram_stealer family
Unpacked files
SH256 hash:
c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
MD5 hash:
720804a1e38299c4ffa1e67a966c8e74
SHA1 hash:
cea752f898cf77bd63d7ed21815746e7abf615b6
Link:
https://www.unpac.me/results/9f2b7804-c4f7-490d-9900-1f7606bf8fe9/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Hacktool_DinvokeRust_512d3b59
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3724268/
Cape
Cape
https://www.capesandbox.com/analysis/42319/

Comments