rust-stealer-xss[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rust-stealer-xss.exe
Size

5.0MB
MD5

94d2f40e712507a697171d22cc630ec3
SHA1

8a704ceecc8626f8ca2c0160c688db15458f1f42
SHA256

85893d402d55d9699da598022d22fa995e66d953998da7f74b0ffd4df4ef7d9f
SHA512

417e1b18a464ace7e9d4bb86677381110b065e03289b2cbf2375c5a585ce10a2fcdb5d4dd1baf4392fa045092aa7111d5bbe05451c7e4f0c82cec08c9a0d579a
SSDEEP

49152:Dw4L41k1OV4xB8JvIKO0NZ50R+1fFgeyBZVbXI3enjoEahogZGeJ53brCdZ+X+vo:M4EP+DARaI3GoEahogAm4Fj6w+Z

Score

N/A

Malware Config

Signatures

Files

rust-stealer-xss.exe
.exe windows x64

a43e8dbcc5f0c1db2d26ea67cd92ae68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

DecryptMessage
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
LsaFreeReturnBuffer
LsaGetLogonSessionData
AcquireCredentialsHandleA
EncryptMessage
LsaEnumerateLogonSessions

kernel32

FindClose
AcquireSRWLockExclusive
GetLastError
RemoveDirectoryW
GetUserPreferredUILanguages
GetTickCount64
GetLogicalDrives
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetFileInformationByHandleEx
AddVectoredExceptionHandler
HeapReAlloc
SleepConditionVariableSRW
WakeAllConditionVariable
GetModuleHandleW
ReleaseSRWLockExclusive
SwitchToThread
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
HeapAlloc
GetProcessHeap
Sleep
GetModuleHandleA
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
FormatMessageW
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
QueryPerformanceFrequency
TryAcquireSRWLockExclusive
SetThreadStackGuarantee
GetCurrentThread
SetLastError
CreateThread
GetEnvironmentVariableW
GetTempPathW
SetFilePointerEx
CreateFileW
GetFullPathNameW
GetCurrentProcess
DuplicateHandle
FindNextFileW
FindFirstFileW
CreateDirectoryW
SetHandleInformation
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFileInformationByHandle
CopyFileExW
GetProcessTimes
OpenProcess
ReadProcessMemory
VirtualQueryEx
GetSystemTimes
HeapFree
LocalFree
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
GlobalMemoryStatusEx
PostQueuedCompletionStatus
GetFinalPathNameByHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
LoadLibraryA
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
GetProcessIoCounters

ntdll

RtlGetVersion
NtQuerySystemInformation
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtQueryInformationProcess

advapi32

RegQueryValueExW
SystemFunction036
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
GetUserNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW

oleaut32

SafeArrayUnaccessData
VariantClear
SafeArrayGetLBound
SysAllocString
SysFreeString
SysAllocStringLen
SafeArrayGetUBound
SafeArrayAccessData

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhRemoveCounter
PdhCloseQuery

crypt32

CryptStringToBinaryA
CertDuplicateStore
CryptUnprotectData
CertDuplicateCertificateContext
CertGetNameStringA
CertFreeCertificateChain
CryptDecodeObjectEx
CertGetEnhancedKeyUsage
CertOpenStore
CertGetCertificateChain
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CryptQueryObject
CertCloseStore
PFXImportCertStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertFindExtension
CertFindCertificateInStore
CertEnumCertificatesInStore

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2

netapi32

NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

user32

EnumDisplaySettingsExW
GetMonitorInfoW
EnumDisplayMonitors

gdi32

GetObjectW
GetDIBits
StretchBlt
SetStretchBltMode
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetDeviceCaps
CreateDCW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

ws2_32

WSASocketW
bind
setsockopt
getpeername
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
recv
freeaddrinfo
WSARecv
connect
WSAStartup
WSAIoctl
send
WSAGetLastError
recvfrom
closesocket
getsockname
socket
WSASetLastError
__WSAFDIsSet
ntohs
accept
htonl
listen
WSACloseEvent
WSACleanup
shutdown
getaddrinfo
select
ioctlsocket
getsockopt
htons
WSACreateEvent
WSASend

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW

vcruntime140

memcpy
memset
memmove
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memcmp

api-ms-win-crt-string-l1-1-0

_strdup
strncpy
strpbrk
strlen
wcslen
tolower
strcpy
strcmp
strcspn
isupper
strspn
strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_msize
realloc
free
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_register_onexit_function
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
terminate
_set_app_type
_seh_filter_exe
_endthreadex
__sys_nerr
__p___argv
_beginthreadex
__sys_errlist
_crt_atexit
_wassert
abort
_errno

api-ms-win-crt-convert-l1-1-0

strtol
strtoll
strtoul
atoi
wcstombs

api-ms-win-crt-stdio-l1-1-0

fclose
_lseeki64
fseek
fputs
_close
fgets
fwrite
fread
_open
_set_fmode
fopen
fflush
__stdio_common_vsprintf
fputc
__acrt_iob_func
__p__commode
__stdio_common_vsscanf
_write
_read
ftell
feof

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64_s
_time64
strftime

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_access
_fstat64

api-ms-win-crt-math-l1-1-0

log
_dclass
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a43e8dbcc5f0c1db2d26ea67cd92ae68

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

advapi32

oleaut32

pdh

crypt32

ole32

iphlpapi

netapi32

user32

gdi32

bcrypt

ws2_32

shell32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 27KB - Virtual size: 31KB

.pdata Size: 86KB - Virtual size: 85KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 27KB - Virtual size: 31KB

.pdata
Size: 86KB - Virtual size: 85KB

.reloc
Size: 25KB - Virtual size: 24KB