rustup-init[.]exe | Triage™

Resubmissions

07/08/2026, 01:24

260807-bsq67aytbv8

07/08/2026, 01:21

260807-bq1mvaej2s5

Sharing

Copy URL Twitter E-mail

General

Target
rustup-init.exe
Size 12.2MB
Sample260807-bq1mvaej2s
SHA256 86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7
MD5 b4c4846e4aaefeadf41e60099f5d2206
SHA1 f48968cb347a8c7279c515709f007067b519c35a
SHA512 20c8eeecb2bbd7132b418b415d860d1df4ae8711a303de66f15a050d0c58db7d7868ac8f0389fb03d1078688173de94bcd13e07377e971caa1b6cfde9c50d75e
SSDEEP 98304:SS0l7dwp2r9+3is18qL3fq3KldqWbqGp7Yw4wYYOC19e/3MVkcw6jKmlWr9mq/RP:TJeudfnldqYpqN/3MVkcw6jKmhqZWAp
TLSH
T105D62905BA9B99ECD16AC874834A46739E2174DA0B36BAFF41C445393F6ABF01F39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rustup-init.exe

File Explorer

rustup-init.exe

.exe 12.2MB

rustup-init.exe

IMPHASH 63d0d364a16d211f1c89f19b3d581ff6
SHA256 86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7
MD5 b4c4846e4aaefeadf41e60099f5d2206
SHA1 f48968cb347a8c7279c515709f007067b519c35a
SHA512 20c8eeecb2bbd7132b418b415d860d1df4ae8711a303de66f15a050d0c58db7d7868ac8f0389fb03d1078688173de94bcd13e07377e971caa1b6cfde9c50d75e
SSDEEP 98304:SS0l7dwp2r9+3is18qL3fq3KldqWbqGp7Yw4wYYOC19e/3MVkcw6jKmlWr9mq/RP:TJeudfnldqYpqN/3MVkcw6jKmhqZWAp
TLSH
T105D62905BA9B99ECD16AC874834A46739E2174DA0B36BAFF41C445393F6ABF01F39314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8683660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rustup_init.pdb

bcryptprimitives

ProcessPrng

kernel32

GetFileInformationByHandleEx FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorPosition GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetOEMCP GetModuleHandleW GetProcAddress FindClose GetACP IsValidCodePage GetNativeSystemInfo WaitForSingleObject LoadLibraryA SetFileInformationByHandle FormatMessageW LCMapStringW CompareStringW GetTimeFormatW CreateThread GetOverlappedResult PostQueuedCompletionStatus WriteFile ReadFile GetDateFormatW GetQueuedCompletionStatusEx OutputDebugStringW CreateIoCompletionPort SetFileCompletionNotificationModes CancelIoEx GetFullPathNameW GetCommandLineA DuplicateHandle GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime EncodePointer RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent GetCurrentThread SetUnhandledExceptionFilter UnhandledExceptionFilter SetThreadStackGuarantee FlushFileBuffers SetFilePointerEx DeviceIoControl RaiseException HeapSize SetEndOfFile SetStdHandle FlsFree FlsSetValue FlsGetValue CreateFileW GetSystemTimePreciseAsFileTime AssignProcessToJobObject GetModuleHandleA GetFileInformationByHandle CreateToolhelp32Snapshot Process32First Process32Next OpenProcess SetEnvironmentVariableW TerminateProcess GetExitCodeProcess GetCurrentProcess ReadFileEx MoveFileExW IsProcessInJob QueryInformationJobObject SetConsoleCtrlHandler GetLastError GetCurrentThreadId SetLastError WaitForSingleObjectEx CreateMutexA ReleaseMutex GetConsoleOutputCP GetDriveTypeW WriteConsoleW CreateDirectoryW FindFirstFileExW ReadConsoleW GetModuleFileNameW GetTempPathW GetModuleHandleExW LoadLibraryExW SetHandleInformation RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW TlsFree CopyFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType WriteFileEx CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount FindNextFileW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive IsProcessorFeaturePresent VirtualQuery VirtualProtect GetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceFrequency GetCommandLineW GetEnvironmentVariableW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar GetSystemDirectoryA FreeLibrary CreateFileA MoveFileExA GetTickCount WideCharToMultiByte lstrlenW VerSetConditionMask VerifyVersionInfoW GetCurrentDirectoryW GetStringTypeW GetTimeZoneInformation HeapAlloc CloseHandle HeapFree GetProcessHeap SetInformationJobObject CreateJobObjectW GetSystemInfo RtlVirtualUnwind RtlLookupFunctionEntry GetFileSizeEx LocalFree HeapReAlloc GetStdHandle SetDefaultDllDirectories GetCurrentProcessId SwitchToThread SleepEx InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue LoadLibraryW LoadLibraryExA RtlCaptureContext AddVectoredExceptionHandler QueryPerformanceCounter PeekNamedPipe GetCPInfo FlsAlloc RtlUnwind

advapi32

CryptDestroyHash CryptHashData CryptCreateHash RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegDeleteValueW CryptGetHashParam RegDeleteTreeW CryptReleaseContext CryptAcquireContextA

oleaut32

SysFreeString SysStringLen

crypt32

CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFindCertificateInStore CertDuplicateCertificateContext CertSetCertificateContextProperty CertOpenStore CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertFreeCertificateContext CertCreateCertificateChainEngine CertCloseStore CertFreeCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertDuplicateStore CertGetEnhancedKeyUsage CertEnumCertificatesInStore

ws2_32

WSACleanup getsockopt connect closesocket bind WSAIoctl ioctlsocket getaddrinfo freeaddrinfo recv send shutdown WSASend setsockopt htons socket accept WSASetLastError WSACloseEvent WSACreateEvent getsockname WSAGetLastError getpeername WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents ntohs __WSAFDIsSet WSASocketW select htonl listen WSAStartup

ole32

CoInitializeEx CoCreateInstance

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtCreateNamedPipeFile NtOpenFile NtCreateFile RtlInitUnicodeString RtlNtStatusToDosError NtReadFile NtWriteFile

shell32

ShellExecuteW SHGetKnownFolderPath

combase

CoTaskMemFree

secur32

DecryptMessage ApplyControlToken FreeContextBuffer InitSecurityInterfaceA AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW EncryptMessage AcceptSecurityContext InitializeSecurityContextW DeleteSecurityContext

user32

SendMessageTimeoutA

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

rustup-init.exe

bcryptprimitives

kernel32

advapi32

oleaut32

crypt32

ws2_32

ole32

ntdll

shell32

combase

secur32

user32

generic