rust-stealer-xss[.]bin

Resubmissions

18-10-2023 09:56

231018-lykxgaed98 10

18-10-2023 09:43

231018-lqbntsed66 10

Sharing

Copy URL

Twitter E-mail

General

Target

rust-stealer-xss.bin
Size

4.5MB
MD5

3ddf7d19049c63bdfd526de82ca592c1
SHA1

852dddd3a28ee5c6949bba4c76a4bfe116c903ba
SHA256

b1c36bffcefa1ade3384c246959d37b651dffbd10cb7172b7c93a9bfecd29f89
SHA512

7be04fed529a3bcbd490cf10549e1439089ba38cd70f7def6b097656c3f3a9c5bf4809f8ddc4b58430ad72e55a9bd367dc4695affa0017c4e6f391ff3318fadb
SSDEEP

98304:hQDi99hkY8zFbsEqy9wvDC1C/eFFYKkjsDTtqK3+5A:ODi99hgqLCSmkjWd0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
rust-stealer-xss.bin

Files

rust-stealer-xss.bin
.exe windows:6 windows x86

54807f73d70983d99cf6db8af0cb8761

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetHandleInformation
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentThread
TlsAlloc
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
FormatMessageW
GetTempPathW
CreateFileW
SetFilePointerEx
DeviceIoControl
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
OpenProcess
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
GetModuleHandleW
WakeAllConditionVariable
TlsSetValue
TlsGetValue
GlobalUnlock
GlobalLock
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GlobalFree
GlobalAlloc
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
GlobalSize
Sleep
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetLogicalDrives
GetTickCount64
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InitializeCriticalSectionEx

advapi32

RegOpenKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
WSAIoctl
ioctlsocket
send
connect
recvfrom
WSAGetLastError
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
getpeername
WSAEnumNetworkEvents
WSAStartup
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSACreateEvent
WSACloseEvent
shutdown
WSASend
recv
getsockname
WSACleanup

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertOpenStore
CertGetCertificateChain
CertFreeCertificateContext
CryptUnprotectData

ntdll

NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtQuerySystemInformation

oleaut32

SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SafeArrayAccessData
SysAllocStringLen
VariantClear
SysAllocString

pdh

PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCollectQueryData
PdhOpenQueryA
PdhRemoveCounter
PdhCloseQuery

iphlpapi

GetIfTable2
GetIfEntry2
FreeMibTable

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

user32

EmptyClipboard
GetMonitorInfoW
CloseClipboard
EnumDisplayMonitors
OpenClipboard
GetClipboardData
EnumDisplaySettingsExW
SetClipboardData

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
StretchBlt
GetDIBits

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

vcruntime140

memchr
strstr
__current_exception
strchr
__CxxFrameHandler3
memcmp
memmove
memset
memcpy
__current_exception_context
_except_handler4_common
strrchr

api-ms-win-crt-string-l1-1-0

strncmp
strcpy
strspn
tolower
strcmp
strncpy
wcslen
isupper
strpbrk
strlen
_strdup
strcspn

api-ms-win-crt-heap-l1-1-0

calloc
_msize
malloc
_set_new_mode
realloc
free

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
_endthreadex
_register_thread_local_exe_atexit_callback
__sys_nerr
__sys_errlist
_wassert
abort
_initialize_onexit_table
_register_onexit_function
terminate
_beginthreadex
_controlfp_s
_crt_atexit
_errno

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
atoi
strtoul
strtol

api-ms-win-crt-stdio-l1-1-0

fflush
__stdio_common_vsprintf
fputc
fopen
_lseeki64
_read
_write
_close
fgets
__p__commode
_set_fmode
__acrt_iob_func
fread
fwrite
fseek
_open
fclose
fputs
__stdio_common_vsscanf
ftell
feof

api-ms-win-crt-time-l1-1-0

_time64
strftime
_localtime64_s
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_fstat64
_unlink

api-ms-win-crt-math-l1-1-0

_dclass
log
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

54807f73d70983d99cf6db8af0cb8761

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

ntdll

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

bcrypt

shell32

ole32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 19KB - Virtual size: 22KB

.reloc Size: 101KB - Virtual size: 100KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 19KB - Virtual size: 22KB

.reloc
Size: 101KB - Virtual size: 100KB