MB-d3e5d5e5289c2e39e12dc91a4e286faf64812bf68c83c1f37e88b2fac79d105c
high
📛 Threat Title
RustyStealer: file
Description
File type: exe. Size: 296000 bytes. Tags: 54e64e, dropped-by-Amadey, exe, RustyStealer, signed. Reporter: Bitsight. First seen: 2026-09-25 03:48:07.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
d3e5d5e5289c2e39e12dc91a4e286faf64812bf68c83c1f37e88b2fac79d105c
IOC database
- Type
- hash_sha256
- Value
d3e5d5e5289c2e39e12dc91a4e286faf64812bf68c83c1f37e88b2fac79d105c- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to RustyStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
ad677925d4ffdde33c4392cc76c615ba
IOC database
- Type
- hash_md5
- Value
ad677925d4ffdde33c4392cc76c615ba- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to RustyStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
0cd488c64d7af8ac72e356aaa23af145
IOC database
- Type
- hash_imphash
- Value
0cd488c64d7af8ac72e356aaa23af145- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- imphash of URLhaus payload d3e5d5e5289c2e39…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
a5d5deeba33eadfb479ea60995cf2336048b31c1
IOC database
- Type
- hash_sha1
- Value
a5d5deeba33eadfb479ea60995cf2336048b31c1- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 296000 bytes. Tags: 54e64e, dropped-by-Amadey, exe, RustyStealer, signed. Reporter: Bitsight. First seen: 2026-09-25 03:48:07.
Remediations (10)
-
web:bazaar.abuse.ch
RustyStealer malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RustyStealer . Database Entry
-
web:bazaar.abuse.ch
Malware samples associated with tag RustyStealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with RustyStealer . Database ...
-
web:cve.tools
Compliance / timeline CISA KEV due date for remediation is 2026-09-14. After upgrade/ mitigation , continue monitoring logs for additional probing attempts. Ongoing monitoring Keep watching for continued automated scanning traffic; exploitation attempts may continue until many servers are patched.
-
web:github.com
This is consistent with published behavior for the SilverFox/ RustyStealer family and is itself a documented finding confirming the evasion capability identified in static analysis. PEStudio overview — file metadata, entropy, and detection summary. Flagged imports revealing process injection, persistence, and crypto APIs.
-
web:radar.offseq.com
These contain LNK files disguised as PDFs with themes related to Russia-Ukraine peace plans, Ukrainian research, and geopolitical issues. When executed, the shortcuts retrieve malicious files from GitHub, deploying VBScript to establish persistence via scheduled tasks and delivering VelvetCake, a lightweight PowerShell-based task runner.
-
web:www.derp.ca
RustyStealer RustyStealer is a Windows information-stealing malware family written in Rust and used to harvest credentials and other sensitive data from compromised systems.
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Suricata IDS alerts for network traffic Found direct / indirect Syscall (likely to bypass EDR) Sets debug register (to hijack the execution of another thread) Contains functionality to call native functions Contains functionality which may be used to detect a debugger (GetProcessHeap ...
-
web:www.microsoft.com
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts. You can also visit our advanced ...
-
web:www.pcrisk.com
RustyStealer is a stealer - a type of malware designed to extract/exfiltrate sensitive information. Generally, infections of this kind can result in severe privacy issues, financial losses, and even identity theft. What is the purpose of RustyStealer malware? In most cases, malware is used to generate revenue.
-
web:www.threatclaw.ai
2.CVE-2026-57171 (Trestle / compliance-trestle) — arbitrary file write via path traversal in author generate commands, explicitly an incomplete fix of CVE-2026-46345.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.