MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 12 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1
SHA3-384 hash: 30a07b0058fdba3d0df7b32f5afac54b51548bf89191ff73b2746fb8a13a7a776c57b28bcf7e03399bf5ff39de5ddc74
SHA1 hash: 83b11d9fa35ed388c500080842d54f38f72e62c2
MD5 hash: aefe1a04a23dc05c87fed024d64ded2d
humanhash: thirteen-magazine-finch-undress
File name:aefe1a04a23dc05c87fed024d64ded2d
Download: download sample
Signature RustyStealer
Create hunting rule
File size:6'364'231 bytes
First seen:2023-02-07 10:10:36 UTC
Last seen:2023-02-07 13:34:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cbd78022b455a6c31705cb5836b561a6 (1 x RustyStealer, 1 x LaplasClipper)
ssdeep 98304:n6Wx8bw2JuUMDqJ0c6BgmHEwFlf/VwkKb7qiULU5sEECjaWWWWWWio57HR9erzdN:Jxlmle4WFlXfKb7qiUKTECoZHLerL
Threatray 110 similar samples on MalwareBazaar
TLSH T10056BF3708C3867CC2A9C3781CC10A9D1B9A783A7E7BDAC29785455AFF5E30739CA519
TrID 43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 005454d4d4545400 (1 x RustyStealer)
Reporter zbetcheckin
Tags:32 exe RustyStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aefe1a04a23dc05c87fed024d64ded2d
Verdict:
No threats detected
Analysis date:
2023-02-07 10:18:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6c15b1fb-6ea2-462b-a4fa-ea1319434d12

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/361325/
Detection(s):
SecuriteInfo.com.FileRepMalware.7884.24905.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/66080/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
anti-debug anti-vm overlay packed
Link:
https://www.filescan.io/uploads/63e223ba89bd67c10fdcf75a/reports/7a63caf6-7fdd-45ec-b380-67b0120c155a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6062579b-9a02-41d1-8382-89ba2930493f
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1167551
Signature
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 800331 Sample: 1D7Cyp1M4G.exe Startdate: 07/02/2023 Architecture: WINDOWS Score: 68 19 nerf-0149-unknown.guru 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected Laplas Clipper 2->23 25 Machine Learning detection for sample 2->25 7 1D7Cyp1M4G.exe 1 2 2->7         started        10 ntlhost.exe 2->10         started        12 ntlhost.exe 2->12         started        signatures3 process4 file5 17 C:\Users\user\AppData\Roaming\...\ntlhost.exe, PE32 7->17 dropped 14 ntlhost.exe 7->14         started        process6 signatures7 27 Detected unpacking (creates a PE file in dynamic memory) 14->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-07 04:49:53 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3l4tjkmotjqrlkfpnqxtjvvqnenfyzofxfrhqabnnxg63xw5mtqq._file
Verdict:
malicious
Similar samples:
2897232c5333d1ba26ab1b9769b1bd87894f2c8d1f6c6c3cb0fa47d8b3afc56d
RustyStealer
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
RustyStealer
4a456d44f22ba4a4e1eaa83510a1872aad10075d95f8c8fff747a28f68d466a7
RustyStealer
58b415a4211b4ab0714cb45cfc92cc793c3f6ad8b1413c5f8320cfc77b5d2868
RustyStealer
707e8d1989268db912cc9c2fc95c82aac61aaee789ef40aa0ccc52ae14282d5b
RustyStealer
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
RustyStealer
b06c5fb7651b8a6c683b62babcabd18da4d992f7d1e0f963c530832b18feacf4
RustyStealer
c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e
RustyStealer
ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
RustyStealer
f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e
RustyStealer
+ 100 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230207-l7yjxseb71/
Behaviour
GoLang User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Unpacked files
SH256 hash:
daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1
MD5 hash:
aefe1a04a23dc05c87fed024d64ded2d
SHA1 hash:
83b11d9fa35ed388c500080842d54f38f72e62c2
Link:
https://www.unpac.me/results/2108e3c7-7db9-4411-9959-ab49d5ae7b4d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2532929/
Cape
Cape
https://www.capesandbox.com/analysis/361325/

Comments


Avatar
zbet commented on 2023-02-07 10:10:46 UTC

url : hxxp://167.235.69.31/rlmp32waveu.exe