��p$y����0+v�[�<�� 2�WP����\rw���2�p)���@$��V�髂�@0�#���(�k���aַ`���v��yqtn^W�N��0�A_��]����:���еI-�le�J9�N��ݒ��;h��#��X��#�~ބ}ˎ��ɽ#�~�t�<�����2��pY�Zi�w��s$��ع�Db��@vKV�����c� -�4c�;)A��5���� �w�-�-���@<C>⩥�~!�\�g���L� �V���M���̲��pY�z`�Ob1���;4�x�cU��:-1�9G:��Fh������j�)�T ���u�70�xv��dto�vT��S���_vN�;�T+�C���?�`�T~[�*�"�� ]*�b����Ƥ2�ÂN��7_j�>�[��h'��π� ��<����C�����`|���庈CQ������jo�Cd�D���u\���h�����U��mrp��'���Y��+0Z�^e��G��#� ] �؆�n��d�&�d�o���&������L#U0��8��vd���V��K��q� �7�4 09O�ŗ���c�@@>}��BR��_�>�eg�M�W#��׀�^B�c4 �%D��AN^���4�m�����J��.~�������j5R�|� H~�[yc(L6��~x{,?,��ݡ ��M���܍�JW/�E�D7����s�|)` CEu?��i��������5���� �mD�A@\����).��'Zk�K�����6H��+��ڻ�e��gj��CSl���L�v (E�̖�_&��h���(;��0zy�5��mխ� Rl�w8��������օ�g�e(3����ߑ�ƚM�G�$�f[{~��ӷ���!�(k�h��k���b�C.�j��ˎ�I�h�#��|:� ��2�d�=�rm)�=e(6?�Q}M��������pܠ���^�*�U��%5k{5~bZ2(Sd��������d4�Th�a�D�����1`NU�ªJd�e�i�]G!��ބ���Dj�D2 (��m!�ى ��Â� ���,�o�hܿ��l�:��$�U��ѥ|��ObYt0��R�g7�y.i��h�/.pS!Z��G�Xi���j���w�A���[)u'� ���)>q*����x���by74� K��m%)y6��-ĠY��o��?~_�Tף/&{m�)��j\��������ĸ0;��v��3=V�^s-ѱsp��迓ս���;HdL%�v����G�oa4�Y�JU�P�#��l��X^ܹ@�"����"YC ��&�u �[/�Ö� �ɐ�#�[Bj)�B��ŝ��LB��\��de��%Y��e���o�#3�����@���.��5�`eNu9g��у�4/�US�oP�R��)��v?�&*j�_����#���R�g����8f<����D2���� �����q7F�T�!�fvV�)ؕ�;7����.hpily���p�6���x]d�Pଚ���#ͲW� �~Z��z��4�ҵ��8��퉃Χ�g!7�L 8QH�<��6��J���JF��O��8->0H�9��G�1{&q7�ȋ����� ������!n2���a��}��/�;��e��O���3���ߧW�َ:i镵&y�N�W@�� �:w�����db�����N���c�.�.$��� �x{�}��@���mdL�)�'�t�{E���!�g4ӵ#y�Wr=�2.<,acܝ�=dn�6i7�$�W�he����Ҩ) 3��Ҝ�zKJ_�}�`����E�%�JM���i����u�%�>h�T}�B��JZ,Wj����Xd�����c���[.m1�6�o%3����5���|�"�1Y!:R�(l�� �[�g ƀ��>���S���y��cń�w�i�j��DZ�Hj�Q��[�dҭ�Uuk��>D���d�$4�S��ۄy�|4���ֱI5$��8��υ�/�<3 �c��7�NR���Իr��!�;���&������'pG>ji�р�H�MD�B�� ���`O#���e�eыwi���D��]{�=���{~pXm�����fceW�I�:��|���s�� L�uڹM%�$�M��Z��(�Um�T=v��fx�����l��p�'�\]����?�����ɸL{j�g�GR�U^(�SomTX�����U�TY�1�m/O��a[����RM�SD���90�.ޣ���VrQ8Z�/�jP5�'���6����-��^i:p���nI��w�mwmʳ�_���ʤ����#���ȶ��ͳ�cb��4�\�aP'��9�������M���P2j|�#X��Y��j�b0�'�x`�⸱��]���eg!F��-v�TX��S��ɬ�������,�wލ���W=7�Y�>ӱ)_��P��R��Dma��b���%3=E+k��osr���α6���vK��E���Vơ���������r��k2����f�Jד�!"�B��}}�=iW'(~rZ&|hJ]4偃�e�q�z������@��r9:4��NZ�\��X�������/QDɛ�e��sYV|震���<�}�79� aT� *�pdR�I����ym��M��d���sb� �b�^����7���k���R���� �7����}ګ"�)Lǂ�ͫ�����R���3����+���m�uFV9�\' �����+=i���n�� �@�np0<6��4���.�=~�0;!�W�M0���{�7(Y���YF�}����N��^��F����=�{`n#����e��Ն�ki8��q#�bZ2�stLf�Ձ��+&we����f�&�$y�^�x���"����'ж���x��q5��0�*թ;Q����K���hLip�#���+�R��n9 ��'�I_+�҆���4�]���]9��<��j����н��?*.���T����F���-�6@�؛hТ��w�n�����<5��-U�L&+䑮�{� �x�:@R6mB.�W�m�G��%W��B�<�#х/�����y�m�9�w�g�7O���߱ ~ͷs۶�3)l��h[c]><
Static task
static1
General
-
Target
RustFull_64.exe
-
Size
5.6MB
-
MD5
077f421e745513e56bc130765e2b006f
-
SHA1
5631443b99073dd9beb9de74e7e72bb3633b31e8
-
SHA256
f2bf58b8fbc94cc4aaa9d24569fd4b60005bbc666f7eb0512469519064e77756
-
SHA512
5d9ea06913137514632cbb2cf4f5957e628d41e1baa06cd76fe6a92be3e14491bbe8b890aba576aad061553a4a7787138d1b38ca69edc762e223bf50f3f041ef
-
SSDEEP
98304:4TOS7hjC43+PdFtujzkOpx3r/4UVQ380uKGdu480arvEg/XAA:8OS7hb8dFtE9px3LNkXuDf8hLEt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RustFull_64.exe
Files
-
RustFull_64.exe.exe windows:6 windows x64 arch:x64
Password: dasasd
46ff44af8c4409624f357fd978c38d65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LocalFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??1_Lockit@std@@QEAA@XZ
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFindCertificateInStore
ws2_32
listen
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
qsort
advapi32
CryptGetHashParam
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 422KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ