rust-owndotnet-crypter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rust-owndotnet-crypter.exe
Size

520KB
MD5

85ff634e3c69ea6ac494d1d9aa47d611
SHA1

4e795ba12bcebef8f81b665a9bdcfcc88cf23620
SHA256

6117732165edd1883d922fb5f8d0f07a46ef40ed46f251535010a773bf9cb17f
SHA512

4b3c376587f103a6a1e69b3da4b3e755a3119e6383c7cc1882bf2889add7a430941e8db522d1bf0aba63de652e6e9bc7b3e4138f884a510e2ec57025239891fb
SSDEEP

12288:bV2MMAnX6n4F2tlURI2L2re/PhRdDJ0FH83DvTaDxUOn:bV2MMAnC4F6z2L2rendSFH83DvTa9UW

Score

1^/10

Malware Config

Signatures

Files

rust-owndotnet-crypter.exe
.exe windows:6 windows x86 arch:x86

cd8bd917a1664f753bd4c2adbf3fa04c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/03/2021, 00:00

Not After

05/06/2024, 23:59

Subject

CN=Micro-Star International CO.\, LTD.,O=Micro-Star International CO.\, LTD.,L=Zhonghe District,ST=New Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:dd:05:5f:81:67:46:2d:0d:1e:e0:f5:af:ca:7a:1a:ed:6b:97:88
Signer

Actual PE Digest

bb:dd:05:5f:81:67:46:2d:0d:1e:e0:f5:af:ca:7a:1a:ed:6b:97:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\rust-owndotnet-crypter\target\i686-pc-windows-msvc\release\deps\rust_owndotnet_crypter.pdb

Imports

bcryptprimitives

ProcessPrng

kernel32

GetCurrentProcess
WriteProcessMemory
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
FreeLibrary
GetStringTypeW
GetLastError
SetStdHandle
WaitForSingleObject
CloseHandle
FindNextFileW
FindClose
CreateFileW
FlushFileBuffers
SetFilePointerEx
GetCPInfo
GetOEMCP
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
GetModuleHandleA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadStackGuarantee
GetProcAddress
LoadLibraryA
VirtualProtect
GetACP
IsValidCodePage
AddVectoredExceptionHandler
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
ReleaseMutex
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
EnterCriticalSection
GetModuleFileNameW
GetSystemTimeAsFileTime
EncodePointer
GetCommandLineW
GetConsoleMode
GetFileType
RtlCaptureContext
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
WaitForSingleObjectEx
CreateMutexA
TerminateProcess
DecodePointer

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayPutElement
SysStringLen
SysAllocStringLen
SysFreeString
GetErrorInfo
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayGetUBound

ntdll

RtlNtStatusToDosError
NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd8bd917a1664f753bd4c2adbf3fa04c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75Certificate

Extended Key Usages

Key Usages

bb:dd:05:5f:81:67:46:2d:0d:1e:e0:f5:af:ca:7a:1a:ed:6b:97:88Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

kernel32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

Sections

.text Size: 211KB - Virtual size: 211KB

.rdata Size: 292KB - Virtual size: 291KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 10KB - Virtual size: 10KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

bb:dd:05:5f:81:67:46:2d:0d:1e:e0:f5:af:ca:7a:1a:ed:6b:97:88
Signer

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 292KB - Virtual size: 291KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 10KB - Virtual size: 10KB