rust-av-killer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rust-av-killer.exe
Size

1.8MB
MD5

db7ea47b1724116e3aa2b6f14bb59431
SHA1

bd0c1ea04d3afc7e2d107d25825175bc185b16e2
SHA256

60593dd88ff43471eae688367d669a4d2a300b842a1a2fabbd0c5d1c599b1faa
SHA512

46ac7b1634a516a91a6794f7d21ad74606880f42357162b7a47ecd36520c1154ec9bf3b720321f3bee7a49f9a1fc751da1cb7166fd0d5739dfaced4d4f23cd9c
SSDEEP

24576:iEfaMyJOaNm3iVUDAv2QSZ5j+t31MMiaB/c/Qn652lOPoSTmcil/VIH06iy5nV:iEfaMDAv2QSZ56rB0C/U1izIU6i8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rust-av-killer.exe

Files

rust-av-killer.exe
.exe windows x64

7ecdcaaf47bfedb074e321ede42d78db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

GetLengthSid
LookupAccountSidW
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA
SystemFunction036
IsValidSid
CopySid

ntdll

RtlVirtualUnwind
NtQueryInformationProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlGetVersion
NtQuerySystemInformation
RtlPcToFileHeader
RtlUnwindEx
NtWriteFile

kernel32

ReleaseSRWLockExclusive
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
HeapReAlloc
GetFullPathNameW
FindFirstFileW
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
CopyFileExW
CloseHandle
SetHandleInformation
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
GetLogicalDrives
GetSystemInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
WakeConditionVariable
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
SwitchToThread
LocalFree
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
OpenProcess
GetTickCount64
VirtualQueryEx
GlobalMemoryStatusEx
DeviceIoControl
GetCurrentProcessId
CreateFileA
WakeAllConditionVariable
Sleep
WinExec
GetLastError
GetCurrentProcess
EncodePointer
RaiseException
HeapFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryW
FreeLibrary
AcquireSRWLockExclusive
CreateFileW
LoadLibraryExW

user32

FindWindowA
SendInput
SetActiveWindow

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

iphlpapi

GetIfTable2
FreeMibTable
GetAdaptersAddresses
GetIfEntry2

netapi32

NetUserGetInfo
NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

pdh

PdhAddEnglishCounterW
PdhRemoveCounter
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery

ws2_32

WSACleanup
WSASocketW
closesocket
WSAGetLastError
select
bind
listen
accept
setsockopt
getaddrinfo
getsockopt
freeaddrinfo
recv
WSARecv
getsockname
getpeername
ioctlsocket
send
connect
WSAStartup
WSASend

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW
GetPerformanceInfo

oleaut32

VariantClear
SysFreeString
SysAllocString

powrprof

CallNtPowerInformation

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
calloc

api-ms-win-crt-string-l1-1-0

strcpy_s
wcslen
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_initterm_e
__p___argc
_get_initial_narrow_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
abort
_set_app_type
_initterm
__p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 983KB - Virtual size: 982KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ecdcaaf47bfedb074e321ede42d78db

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

ntdll

kernel32

user32

ole32

iphlpapi

netapi32

secur32

pdh

ws2_32

shell32

psapi

oleaut32

powrprof

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 983KB - Virtual size: 982KB

.rdata Size: 800KB - Virtual size: 799KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 21KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 983KB - Virtual size: 982KB

.rdata
Size: 800KB - Virtual size: 799KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 21KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 6KB - Virtual size: 6KB