rust-stealer-xss[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rust-stealer-xss.exe
Size

5.8MB
MD5

cef223500250aef7b78ca318fe168e3e
SHA1

cb4e232f24800466cf6c7bf940046ef107075361
SHA256

0532caaaee1ea76a55ff35f707dfdf5491a8a52f3b6fe53fedba3d817f80a292
SHA512

49768813cc2c090753f0d9eed9a9bf31c75290c9dc1c3019071a1bbfc62a38d1fe04f3fec6c75e33dee5e67ae2fbc0390535a23483c0b5b4d185e8bca58f25a6
SSDEEP

98304:0li0YSy5dP26vytLqQF9UPAxaJhMFAn+nF:D0Cn26c9rxaJAm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rust-stealer-xss.exe

Files

rust-stealer-xss.exe
.exe windows:6 windows x64 arch:x64

616fb7efc619ee8ce8c233d139e2bd0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rust_stealer_xss.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

ws2_32

accept
WSADuplicateSocketW
select
shutdown
send
getsockname
WSASend
WSARecv
recv
getpeername
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
connect
ioctlsocket
closesocket
WSAGetLastError
ntohs
WSAResetEvent
WSAWaitForMultipleEvents
__WSAFDIsSet
WSAIoctl
htonl
listen
htons
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
socket
WSASetLastError
WSACloseEvent

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CryptUnprotectData

secur32

QueryContextAttributesW
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

advapi32

RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
GetUserNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW

kernel32

SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
GetFileSize
FlushFileBuffers
ReadFile
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
MoveFileExA
Sleep
GetTickCount
GetEnvironmentVariableA
GetSystemDirectoryA
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetTempPathA
CloseHandle
GetLastError
GetUserPreferredUILanguages
GetTickCount64
GetLogicalDrives
GetFileInformationByHandleEx
SetFileInformationByHandle
SwitchToThread
DeleteFileW
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetProcessHeap
HeapFree
HeapReAlloc
GetModuleHandleW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetLastError
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetEnvironmentVariableW
GetModuleHandleA
QueryPerformanceFrequency
FormatMessageW
GetSystemInfo
GetTempPathW
GetFullPathNameW
CreateFileW
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileExW
FindClose
SetHandleInformation
CreateThread
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapAlloc
CopyFileExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
VirtualQueryEx
OpenProcess
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
GlobalMemoryStatusEx
PostQueuedCompletionStatus
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
EnterCriticalSection

oleaut32

SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SafeArrayUnaccessData
VariantClear
SysAllocString
SafeArrayAccessData

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserEnum

ntdll

RtlNtStatusToDosError
NtOpenFile
NtCancelIoFileEx
RtlGetVersion
NtQueryInformationProcess
NtDeviceIoControlFile
NtReadFile
NtWriteFile
NtQuerySystemInformation
NtCreateFile

user32

GetMonitorInfoW
EnumDisplaySettingsExW
EnumDisplayMonitors

gdi32

GetDeviceCaps
GetObjectW
GetDIBits
StretchBlt
SetStretchBltMode
CreateDCW
DeleteDC
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoInitializeEx

shell32

SHGetKnownFolderPath
CommandLineToArgvW

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW
GetPerformanceInfo

pdh

PdhCloseQuery
PdhRemoveCounter
PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

vcruntime140

__current_exception
__C_specific_handler
strstr
memchr
strrchr
strchr
memcmp
memmove
__CxxFrameHandler3
memset
memcpy
__current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen
strcmp
strlen
_strdup
wcsncpy
strncpy
wcsncmp
wcscpy
strpbrk
strcspn
strspn
strncmp
strcpy

api-ms-win-crt-math-l1-1-0

pow
_fdopen
__setusermatherr
_dclass
log

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_narrow_argv
_seh_filter_exe
_endthreadex
_beginthreadex
__sys_nerr
_initialize_narrow_environment
__sys_errlist
_get_initial_narrow_environment
_errno
_initterm
_initterm_e
exit
_exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_cexit
_c_exit

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
wcstombs
mbstowcs
strtoul
strtol

api-ms-win-crt-stdio-l1-1-0

__p__commode
fputs
ftell
fseek
fclose
__stdio_common_vsprintf
fopen
_open
fputc
_fseeki64
_set_fmode
_read
fgets
_close
_lseeki64
fflush
_write
__acrt_iob_func
fread
fwrite
_fileno
feof

api-ms-win-crt-heap-l1-1-0

free
realloc
calloc
malloc
_set_new_mode
_msize

api-ms-win-crt-utility-l1-1-0

qsort
_rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
strftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_unlink
_stat64
_fstat64
_fullpath

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

616fb7efc619ee8ce8c233d139e2bd0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

advapi32

kernel32

oleaut32

iphlpapi

netapi32

ntdll

user32

gdi32

ole32

shell32

bcrypt

psapi

pdh

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 27KB - Virtual size: 31KB

.pdata Size: 114KB - Virtual size: 114KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 27KB - Virtual size: 31KB

.pdata
Size: 114KB - Virtual size: 114KB

.reloc
Size: 44KB - Virtual size: 44KB