MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
SHA3-384 hash: e3493312f1e141b386fc3202e39bb41c72685ee4c4d32c95c47f5f5fd1388bea71877f5b862124014ac7171421d00acb
SHA1 hash: cc42fdbbd5b0c6b4b7e2f3056553371a98962a62
MD5 hash: 3a2aa435122623425a95e0323c81fdc5
humanhash: finch-three-solar-failed
File name:SoftWare.exe
Download: download sample
Signature RustyStealer
Create hunting rule
File size:11'093'378 bytes
First seen:2025-12-10 12:58:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d5b6c89a890635218157908ec7f3427 (2 x RustyStealer)
ssdeep 6144:biJW5zdp/R+4jbwYTb2sZ+JUHbsKhR+g4pxdr57D5XcEbdIN0Dr9XDOX/DBZuoEl:2JWL9lbvZ34pxXDuRNoA/DG8uMYMFNU
Threatray 80 similar samples on MalwareBazaar
TLSH T10EB6AFB7B1912CA8E356C03D8357A17BAF3BB58727126FB716A888306E53BD12F04745
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter burger
Tags:exe MaskGramStealer RustyStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
SoftWare.exe
Verdict:
Malicious activity
Analysis date:
2025-12-10 12:56:33 UTC
Tags:
stealer maskgramstealer
Link:
https://app.any.run/tasks/0d60ec34-c129-48cb-9261-eeadbde1aebc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44162/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69396e6ebde6a3e5970fd8d2
Tags:
ransomware virus crypt
Verdict:
Malicious
Labled as:
Win64/GenKryptik.HNRD trojan
Link:
https://www.hybrid-analysis.com/sample/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-10T10:16:00Z UTC
Last seen:
2025-12-11T01:03:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Vidar.evy Trojan-PSW.Vidar.HTTP.C&C
Link:
https://opentip.kaspersky.com/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b89970b5-8cab-4b60-a8d3-04ab6d785835
Result
Threat name:
MaskGram Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1830207
Signature
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Leaks process information
Malicious sample detected (through community Yara rule)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Yara detected MaskGram Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3a2aa435122623425a95e0323c81fdc5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c/
Verdict:
Malicious
Threat:
Family.MASKGRAM_STEALER
Link:
https://tip.neiki.dev/file/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-10 15:12:12 UTC
AV detection:
11 of 24 (45.83%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wwqpm2lyxp5aqgscgulbrd67yeutktkygvjfn6cs55riatihuwa._file
Verdict:
malicious
Label(s):
maskgramstealer
Create hunting rule
Similar samples:
2229d93f6a97610c642b07f6849510b6e72ac3d19ce60f13bf3df253ab7e1cf2
RustyStealer
6beeeffd74398fb4435004503348c210c838f3d6f955b7dba54a85e9ae5ceab3
RustyStealer
8201551520d88da852863c340230da37feff7e3f0a99d983c29baf315af37a49
RustyStealer
976ad1637dceb8ee8940c40db3fee072d59301693df566f530561ad69ad3f2a9
RustyStealer
c43d0f6099f6e23d51d1488c016cb8337a52c0cb5a90e514d80717727ac9b6d8
RustyStealer
c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe
RustyStealer
c88f36ae0c516191d722cc66275db2292c1535f786462af3d3a9eac3a1eacf86
RustyStealer
d0459a84ffc9b6f7eeb627e90b1879e8d1e477baff9db93dde2568c6100b6b3e
RustyStealer
ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
RustyStealer
error
RustyStealer
+ 70 additional samples on MalwareBazaar
Result
Malware family:
maskgram_stealer
Create hunting rule
Score:
  10/10
Tags:
family:maskgram_stealer discovery spyware stealer
Link:
https://tria.ge/reports/251210-p79tqs1je1/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads WinSCP keys stored on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Detects MaskGramStealer payload
MaskGramStealer
Maskgram_stealer family
Verdict:
Suspicious
Tags:
Suspicious_POST_body
YARA:
n/a
Link:
https://app.threat.zone/submission/00a4e3e9-cca6-4610-9f61-8af4a0de9d1c
Unpacked files
SH256 hash:
ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c
MD5 hash:
3a2aa435122623425a95e0323c81fdc5
SHA1 hash:
cc42fdbbd5b0c6b4b7e2f3056553371a98962a62
Link:
https://www.unpac.me/results/de903bcd-0460-47a8-a923-d9cf6a2e4db5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ddad07b34bc5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Hacktool_DinvokeRust_512d3b59
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/44162/

Comments