)&ʝ���e����E(��u+π�e���5���]� 0�!�SS=���q�M�b��)����cYh�*��-��矨���dXK���)0>��.��1�uD��Eyf �Ϥգ�c�t� _�&A�<�C>䗅���t�wEX1�0�zX����T�3l��it�gIw�\�C!��Nm�O��t���'*��_x��"��i-6u�q��kU�>��F��d!�Rbjǭ.F��w�)�ћ{�+u�T��}U�u���d3G;j���0 ��wO�`Le���{�>��^���ı�M&���r��µ0~|:���r��6�re5�B�8�:g[%Ue���fl�C��z�d����z�,���U�r�s�^��W���g�����c��4�ŐU����%������Pe,W֍�I��H��O �|�`���!9א��NwPZ�0����-���!��f) t+�c�!���lc�_C콷N��5?T_��������靎s<jJ�8V��G�IK�ڞĹ<�.֬`�>��[��F<��r� �f��ֺ���,��{@�� ��6�;E0˻O" >WS[���e�{�r���d��vlWKd��?I'�� D����)w5��$҈�?����������,�R��%��B[%�%���ki&-��z[�Ҳ�m�5PԘ���SR���й�X](1-�BLy o�a��A�V�ͼ~���w�\o�v��C�FUQK�?����^`z�Iݒvg��m��1IQ�eEǩ�0�t�O�f�����N��[�dC�2v���s��cbqG�����id_�@��4�X�x��,�Wѱ"qqa�@��{�q��a!�t��C�7Ұ��j���P�+���:��vl ���ݺ�� �D|tW�ns�q�ň��1T��)�c�Ab�����B�� 6��;����ߗ)�� n���<�#�Z %G'q�������'Q,�ڑw+��Tr��0������S��A���:!z8�U��"h�����4J� ^��������\M a /@��֎"��hffj-�Q�p��j��Bd]u���^8���pO.^��}0�an �J�K���%��� � ��O�(^�3F�OΣP�A���r^�~֑g������4�Q��D�(� ���u��z�1'oq�����%��y�frBM�̅�'_�Y����v\�o�8F�CD��\-��m����|7iګO�2��51��� �A}��^j` ��\iA^�O��`/�v����(GŘ?F�l���pTm�%�~��rkq-ah���&U3}H&Q7l��y�m�!����k�DxdRE�h��]&��@Y2T��x@���m��I:���n5|��Tq��D�jAq��#�4aB${����ZTg�q!&����d�2���j��w������@�XT�p�]MTZY<�L�����V^��P{J��J�oi��H��<<1���G,���ᦤ��ec����������9u,F��L)7�1�����)K����{ᇫ�Jn��&��.(v2=�������g�vui3�X����4K����@,��q����=��G��{��?��s4�F�h]4a�«d �R��oK�y[E�îP����Q�����������o�t��s$�%�1�8��eG%��2�ڨ�W�5�xÀ�6�٨iC�6|�!��=���a鮕.�7T�fn��,6�C� `%����cT��#z��D)� ��#�,Pb�kV(N7�>fW_]{���I����L�Sl���õ�[N��&��_�J"���ל3^�������������~H�}�����ɯ�n5Vg�q�ӿ��2��^�ߝ�zs��% P���3^��C��곦�E��S4��{�y�GO�����p����v.�(S���-�e�`s%:zw�!ބ�)� ��R��C��-r���`v�\�����v�(A\$�t�H��[kW#S��6�Ծ��J�!��L��ǫ�9؉̾�ONg>o���� Bt.�"� U Bg��MwV{xt?��}ָ�9P8���P*r�0���ׂ�t�Mw�jI��r�/��ɝC~�^ ����e�9�CQ��a��d�ë��:�Mfò�.f��C�"K�E{������r.�D��Ӈ�p���@��o�]*���������dl��.�J �[��lx ک����涓:d���V#ȳ�Q�%h|(��L�'=��;9����?Y&@4�U�;uU?~R�p3wU��%�h���*H�5c���̶�a�R� �%��j��;���9�����іր3�����́zj�<˜tH�)�C�������"|��'a]X/s3�x��SǮ?̂/�h�T$���R�wp�R�������ژ��R��~܄���9�� �r��kH]�A#a+(.%�P�����&��{�!4P�I�t9�*��N�-R�����9�@�=3#4����������y5v6�M��4��d�Z�������\I���Н�ß&.?]Y�\��<�w�Z�5��?wo˹᷍q]���P%�ݬ)�i�TM�t�tԥy�ɋ�u���Rk:��ӉtK ����ܳ B���DS��+�h���<e^�9}?0jW�0��q�&�\X3;��6Ehjό3tꏭu��̏`�lGB���*)�և�����j�\C`P��[�y��dC�p�$�lM��4�=��_�P�͚Ö)M�Џχq��#V0g�`���)j��R7$���PN����6uV��[? \V2�Ş-�H�� �Ō����7Ze������j�JR���N���c���LJ4��BIЦd��8QN���эI��hG�Ժ��>d5h[(����C��9b��o>�oڡ�$N)��ێ� �y�*M��V��cR��e��Ś�a6{$I!��i��~d 1+��6M��O�B����{'I�l��nD�=��{-�w��nh:�;�_��~�9>�d����o��,�MF���������<�uJ��K�8T�� �Nhk3�F��+?��^)k�$K�l����{�{7���J�@��)�X��;l�I�FVZ��S$�/Q��&v���� mK
Static task
static1
Behavioral task
behavioral1
Sample
RustExternal.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RustExternal.exe
Resource
win10v2004-20240802-en
General
-
Target
RustExternal.exe
-
Size
6.3MB
-
MD5
563822f2c10effe5a8f5cbfb1eff8e33
-
SHA1
ab4d75800562d413f7c9379a1f59b4bd82b6af48
-
SHA256
1eb1b40b62ed0ecfa78e8830a3073bb0c09e0b7fb1e9fda9e02fd484f78f44f5
-
SHA512
4a2703246e08ce0da5f27ee233ccb41c2f88afaac6276c41e244cc4a25b2d548d7ba423e53cbca197c488ff2e1dbd0f3cd26c094d116f521f33bacf6ebc1c41c
-
SSDEEP
98304:/d5guVo87iiy8n0/P9d0FuVq4CstUlZLPNEZFpI69G9YOAS0YdiV/4U5y:FC8o87ii74FaYk4C7lZLyI6L3VAUY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RustExternal.exe
Files
-
RustExternal.exe.exe windows:6 windows x64 arch:x64
88ff5130f1668793f584f7a2e274bc28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetSystemDirectoryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
advapi32
QueryServiceStatus
d3dx11_43
D3DX11CreateShaderResourceViewFromFileA
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtQuerySystemInformation
normaliz
IdnToAscii
wldap32
ord211
crypt32
CryptStringToBinaryA
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_wassert
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
localeconv
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ