YK�ew D�PO��0����s��X�� �@�%5� >�}*(t�ÖDH�fВ,S(.��1Rl�M�|lF6���������������|S�K��U�N��OSՌ%�Э���8���\���������g�"Ǔ���r��f�0'zF� 9��24؞K�ު�9{h�ۚ���1� 3�/��~ /�euW��A��Es���;��J����N�~�6�ޢ!i7H�x �;�Q��,2�S�y5��lD;����z��Gf[7� ;��*3�;���T(�NkbR�N\����N��oE:m��p��3A���K��2>�@Ɨ)#D��(�gI��6�ó����=?pX�<��3��I|"����[ z��dt��9Һ��E�7�(�%��B�hL���X2��"�� �����Q{ny��1s3S�K���$����)x�#��9�}�3���I9=��j� v�����������ѷ#G��n�v��2I��K��BX��5�v� �6Z{%*�v ��*� ��N��G��)��"2�O�Y}��Y\��*dw���Ҷ��T�Ss�Y�%"�Q��c�y$rO�$M�Y��{���sY̸@+�ߌ�*������9��$����3�\��au�~C���������Z�9��P��a�[I�Ӯ�Lod>��'a��b+�X���;��C�=���֘��9�j��a�:| ,^Ϧ���^c<��@\�#��8�}2�ݹ�����QtZ�aLfJº���y��7��2���[E����X��y�Q�1LV�/_G�@�uKم0��~f^����@t��|Q�����1�6vm���`��j�2t�۰���Ө4�a3�`���||8F� Z9�I����բb����!Y���w�J���ԁ�;0�%�$/�n[3h����QFg��K=�H|��k�[*ޕ �(�����~��@�*����4X��>�BҋS�YJo� ��]�]��se_�[�,�p����Y�T��T]T���� C(3QL�j��>�Wq����g!_N��L\תF6rujW �C��@�\TT��4Y&���f��.\&L�bN�ɘ-�^o��Φ��ÿ`�lģI���u+���ܒ�_h�C|�Y�e����oۣ����$��<FF��2��>a�y<�!l��d!��1��4�*��f�u ��tRkN2�נ�.��� �m����c�#U�W%u������{��i�������'͎��Z�<!��BL�ܷC��(PH̦½N����r'mzR�t�&%2U�:��p;���{ȿ�cGDnc\���#Q �ϱ������1V~��2Yſ�����tw}8�T���"��A�7N�N�r)�cwT?L�LIF�LTI�Gh��dgkD�H\����E��;t;� �3������Y�g�Pbۨ�^����{ۨb\���k�N�+�����K���f��$�����������8ߵ�)_?�`���!��2��]��4��:R�/D�Ob����TC ��� �$�>�Z_Q�g{�C:� �t�����;j��_�4F�6�6�9�k�*~�դWy��(�-��Y-$%��AX� ( $��s��u�z<>��r��u�÷�ׄf���_���ɀ����r�|�e��w^�&�O �0(���#:d���*��GoLĴ��?!Z��w�L��I%K�5[��D�#!8�{L��2>@��^�� &�5.�wbwS[bfzH��%��u��k���n��p��I=�ᖠ��9�vY1b;���;�H�����Kv���6�B�V�2����GX��Q}�)��R?u|U ��$��q����E�^*���:����8�D�+�[abl�>�!f�W��K[3���+r)��f%J6*����L<o;��B�c�@���Q�� _�èʚ���U\b���2�_�������F�Z�r�-�8��o����P������V,�%��wt�{0Y�bF�#2��v��Э����l����Z3/�k�x�g�E��R�%�dWc��z{���z� z������(6i��=���F#Q�ܖ#j���̅=��s.�� O�)�)e�%�����+��Db/���"M����/:���en�L���zM�$�NZWmk�;�3�\�$���`�����G^ðr�����J Ig@\��܋)Z�U<��橱Tv��e�z�,��z��T����sJҎ>%�(�t w9P��W�]�%�O�!���P���J`��MIo�������}��U����)5�Nj,�7j3�>��0��j�Ѓ2]Z��Pq4��O9��XG��m{؍(�\��vAWGߕI��dy�2�N��X_T�����*�}Ա�R#&�fO��� O�<ճFJؤ/�Y�������b�M�A��7O��3vբ�w��-���u�108L��Iq��^�q|[�B�U:i1ӿtW-ms�.�J� B��{�y>PY"r���0�xaSS�4���QP2���j�w�Q|A{�:�/�b�t�ȵ��}'ߛ�w|Od����n��#�؆��Ff˂��ͱF���:����Uȱ��*z�c�� �t�2- sG�j4�م�Eu<;�%�j�H��G�V��Ή�R��[y��0����#���T�AN C��A[C��Z��2 r@u��H)~�tK�U�C)&1$�3ɫ��eU�A4C������6+'���Y�*g��Ū`�v��٣��Z}��.��'��*��R�J^N�ՙ)����G���P��<�Bs�yPs(�ݱ���-�*O�U_���!����;<z$�l�F�(^`o:�y�%"��]�!y�4���q]�5���q@�����g����5��� �sj�� (���G��̷�S��,0�(˧b��z �ޫ��N�"zS�3�:��; :�sןlH8��;=��X�W���]^/Ĭz=o�� J�u������٭����V@���������i>�ɘ��T1���㥳��W$��枤U�;z>(�@� ���!��0�s�n�e&s)�Z�1 ӹ6��\��R�*f�*=-�[[8�μ�� �]'��}��@���"�\V9��L���t �-��H�y�*�6�
Static task
static1
Behavioral task
behavioral1
Sample
RustSimple.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RustSimple.exe
Resource
win10v2004-20240226-en
General
-
Target
RustSimple.exe
-
Size
6.2MB
-
MD5
6a9e38332b051450c430829617da0004
-
SHA1
c6e5655de1b14717fa3c708fff2d9e3425c00d36
-
SHA256
bed64e229c2f5841cc5ed31f91008e26d69b808812ef7932f069507ca023e71c
-
SHA512
c17299f4ddb66d188e14c0cd9071b1eef1db22412560ff375af4ad8e0eb2b34dbfec14bf60a19742d345dea838f37b0ddd0937a915a31ff91c543a3fdebd95e5
-
SSDEEP
196608:LRyhquEFEJSibAfN6OYPISrCh0I9fmYePpiy2R4:8hquEFwA8HPsR9OYePQy2R4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RustSimple.exe
Files
-
RustSimple.exe.exe windows:6 windows x64 arch:x64
Password: infected
36be9fcc6b198f38f11668fb05018395
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTitleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
CharUpperBuffW
advapi32
QueryServiceStatus
msvcp140
??1_Lockit@std@@QEAA@XZ
ws2_32
WSAStartup
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wininet
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ