"�U"�\@�5ҹ$9���z"��AZ�'��@D��Ivl3Gg�aNgmJ��8Z�����P�.�ӇsG;�����e��_�rKsH���0,ڝH���d�/Gr�Ъ�϶M�OW�a+����ܢ/��^���LL���(��k����Ad��֛r�z d�۲��0�~�Z��4�EI��� y��O6��d}�jU�E�y�o�a��W*�����Xr?�0>�Viq�%�zT��X,'v�E��oTm��ٴ��U�����Ir_kS<Z�J:9����#��� 9d�R5��l�-�-E��1J��pz< ��)DzEVɐ"Gg����/q�]4�����V�nzF����#`���� @��>O����+��.夠zfRZ imv�"S�����'��H��֪z��4�����m�Bf���S��ܕ��<���A����"t��������*��V�p"a�� Y�fj+��.Vu�0��� {ĦQt�Uo�xdh�;�\ �f�S��/�Y܆�|��|�#�u:|0`�ZA��`�[��K�SԾK�r8V���S_Sz�(S��,�-S���Ë�#1r�s�@s���b�pF��w$N���z`��n�`��ن��U��ѣ5<8�k�-�c] A��#f����� p�gl|��kp���WۏSEchξC�jȦE�7�k`�|��`f����x2�P������&�!7X*5�hTh:��K�y|P �y��黁���r��n�������G܅���Y��� &�2�*Rd�LE�\�*�#����^�WIZ����@�C���D�6=�}��K�W���F&� ���o�F k�(+e����l���j�b��J��_r��E��1�g�Ky�3!w��x���+��co�!uP��D$g�e���~�NU��fG9���'r}�3�G���Ff�a�!�.�O��ʼnn��QH2� :�)oL=���RWf��͗"���ŏ�Q$#@�U ������<<�S��L����f��Ț�����V��T�z�C������%,[r�c�a��y�ut�S8ew���ů�����1���F.J��$ɝ�'��5[�D�b� b|w��@���2��σz�*�tm�K���Y�ٔ���_��j!*�W�:}b��&H����чַ���U��$]G�#����^'��~�%3b�RB�H�}p o�r,f�է>M��%QK�)J��!�CH3����|͏�?o����RP]`K��9���Ry�n�̓Ժ� �ɿ��F����^{٪�N ���7K��.z���jA�"Jڤ��g�A���}K�A�#vvn�b"TCۙ���pj��ъ ��xH�o�>\(���2��^��h9�xz J���l��:�8�u���+�C�]YT�r0�<Ӑ�h߫�K��lLb�����a��q�#�C��f+�%�n���6~���a/���um�9,bt�j�fTnK茒�C�>��:z��gj1+;ᯮ�HT$S��Ʈ_~B�z�����U����[|��j�}d� �[-�g*��U��uQ:_�e�NV�l����&M�9��<�Y4�0>Y,��N�$vH7>�o����feI.�^x� ms@�+r MI������-��u�o�)�` �PN�>��F螹��'��|�g������]���� ��#�8�xe���|d�B�'��@RdQh�]���`'�F���_U2=m���n����bM�_��d�l?4�-�}* �L-m��_�ex`s������v�\���}�i��"��Q�G(��H���P��ݜ��q@����o�h��\�{���-�"x���;xTa �:�B��a���F��G�f��c�p��2�E�ёBg{rl��Q�KZ���#"KN-���C���?�jy��������@ w�7h�e�ړ�U���_1���ksvB?*jnK7x���>< K@�?�\���f@S��3���ژ��}W�B3$���r|%��U��vp�ܴ�N`U�%��V�q%)0L�����Ž#��Cu��y�C [^�ǐJ?@�4+/��FWڨ�^�����Di�ph�( ��d�oy8z��1������jl���q �G K�}����**cW~�&/�odOثP�%_c�9lT�:�-$o>�I���pJ^�ѝP�d����Q+E ��¹�}��%cs���~���F��c�nw��0��x�T̜F_���1�)B��5,a �~K��Uw��kE�L��Z^}ٜ�2��1T(�0+��;_$��T���Ө3m�[�3L�?q`I�碇����/��3k$ �d�g�g-���M*��q��߾�0=�i�Կ6cZ�C��a�R:������t"����gAkk*���I�,!N �K�B\�T��T?՞4���C�9�S0k�賑�Ky.+��@V�t����P���8R���٫���1�PY},����S��<y����w�ᭊD�)�ņ��jdu{�X�-�xD���m�e�x��/ ݨ��a�QaA���Ĭ?S8R@� ��v��8,\��n;�bJ�-!ީ��s�o�xl��y`�J�����^%)}BJ�Y�pu�7u��W����`s�9��I�S�q�l��E�i��L%�X5��v3�*���26�������P L)|�G��E%������Qx�}2�+z/�[�@�]����蝘s���Wt�@���� ���Z|�˸۞I��6.Fbr'�.P� ������\����ogn|�`�'��b��H?��\.��3pxK�B�����U^u���ޤc���N!��I��Is�!�m��{*l )�P�8��� ��� +�2h�)]e�d���2C��!Lܕ�\��D%�p����l+QQ_^F���+��75��I�U 2��.@q��6��~�$��1���>�(>�2x����v��|>ĶLHo;IjC1� �8����hRKR�8#V_��\�Ԇ� �����ӏ������� |�N�����,G��nF�B���ƺ'�����,Ji���6u��18�>S[(!(H��WO�����(v���bGۜ7�^܈+� FV�)*
Static task
static1
General
-
Target
RustExternal.exe
-
Size
6.3MB
-
MD5
a94e2bc3fc2396d6d020a2294ea91cad
-
SHA1
6d7e7ff627d1476c2d7d8dfeadad44926efa4c17
-
SHA256
c6e18c9698e7f813ce75890c5347d4a3dfa6dabadba8a37e2e844cb8c0f9f878
-
SHA512
5c376c0621aa3db7daee7c2774481e1277aa1e56ac6ee5c532f1589648e0d0473ed51c252e04cb5ba609479181754edc23de62cc91c31e823c1e15155641b70f
-
SSDEEP
196608:Cr3T1Wt2gaonICz9r+s3BOZ8PqoierIY0fX:GPloICz3kZnN6IYYX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RustExternal.exe
Files
-
RustExternal.exe.exe windows:6 windows x64 arch:x64
88ff5130f1668793f584f7a2e274bc28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetSystemDirectoryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
advapi32
QueryServiceStatus
d3dx11_43
D3DX11CreateShaderResourceViewFromFileA
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtQuerySystemInformation
normaliz
IdnToAscii
wldap32
ord211
crypt32
CryptStringToBinaryA
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_wassert
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
localeconv
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ