RustNewRecoil[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RustNewRecoil.exe
Size 3.2MB
Sample260814-g4algadr8v
SHA256 fd2eeadbf53f3febc0e0834e086b6b35e204020dd39be7d56119d36818f3a03d
MD5 10409a5f7539a1fa5f8c95834cc70fb3
SHA1 6b5c8f48a9154fb4c6e2eef8c62e4cf768745da1
SHA512 6de1b51f87627b22c48ab9a005ffd6e2b691eef6816a8b2658ce0d91b7e82a060261f839c394d8007d958c05975864ace031a720417f2f0c9f6dd8afc15deef4
SSDEEP 24576:O7htCZJMcvQWbzLss5b6MgheGx0stJRgI3Gfnt/dQCCTn9:7ZJMcIWbd5b6btJuPt/dQnn
TLSH
T139F5C62572F955A5D1AAC039E503972BCD60308A533D51FFA3C589C47FA03E8ABBCB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RustNewRecoil.exe

File Explorer

RustNewRecoil.exe

.exe 3.2MB

RustNewRecoil.exe

IMPHASH a78eec4edd35c944f626a868351eed28
SHA256 fd2eeadbf53f3febc0e0834e086b6b35e204020dd39be7d56119d36818f3a03d
MD5 10409a5f7539a1fa5f8c95834cc70fb3
SHA1 6b5c8f48a9154fb4c6e2eef8c62e4cf768745da1
SHA512 6de1b51f87627b22c48ab9a005ffd6e2b691eef6816a8b2658ce0d91b7e82a060261f839c394d8007d958c05975864ace031a720417f2f0c9f6dd8afc15deef4
SSDEEP 24576:O7htCZJMcvQWbzLss5b6MgheGx0stJRgI3Gfnt/dQCCTn9:7ZJMcIWbd5b6btJuPt/dQnn
TLSH
T139F5C62572F955A5D1AAC039E503972BCD60308A533D51FFA3C589C47FA03E8ABBCB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1227831

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mwa73\Desktop\RustNewRecoil\x64\Debug\RustNewRecoil.pdb

kernel32

LoadLibraryA Sleep GetCurrentProcess CreateThread SetPriorityClass GetConsoleWindow CreateFileA FlushFileBuffers ReadFile WriteFile CloseHandle ClearCommError GetCommState SetCommState SetCommTimeouts InitOnceBeginInitialize GetTickCount64 TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared VirtualQuery GetModuleHandleW HeapFree HeapAlloc GetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId RaiseException GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock QueryPerformanceFrequency GlobalUnlock GetProcessHeap GlobalAlloc

user32

ScreenToClient CloseClipboard OpenClipboard WindowFromPoint GetWindowLongW SetWindowLongW LoadCursorW SetCursorPos ClientToScreen GetMonitorInfoW EnumDisplayMonitors SetProcessDPIAware TranslateMessage UpdateWindow GetAsyncKeyState PostQuitMessage PeekMessageW GetCursorPos SetCursor SetClipboardData GetClipboardData EmptyClipboard MonitorFromWindow TrackMouseEvent DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos IsIconic BringWindowToTop SetFocus GetCapture SetCapture ReleaseCapture GetForegroundWindow SetForegroundWindow GetDC DispatchMessageW ReleaseDC SetWindowTextW GetClientRect AdjustWindowRectEx

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

advapi32

RegQueryValueExA RegCloseKey RegEnumValueA RegOpenKeyExA

d3d9

Direct3DCreate9

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

msvcp140d

_Thrd_id _Thrd_join ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ _Cnd_do_broadcast_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?CaptureCallstack@platform@details@Concurrency@@YA_KPEAPEAX_K1@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit _Cnd_broadcast ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_counter _Query_perf_frequency _Mtx_lock _Mtx_unlock _Cnd_wait

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyA

vcruntime140d

memchr memcmp memcpy memmove memset strstr __vcrt_LoadLibraryExW strchr __std_exception_copy __std_exception_destroy _CxxThrowException _purecall __C_specific_handler __current_exception __current_exception_context __C_specific_handler_noexcept __std_type_info_destroy_list __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

pow atan2f logf powf _invoke_watson exit abs _CrtDbgReport _CrtDbgReportW _errno abort strtol terminate _beginthreadex _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit cosf _seh_filter_exe _set_app_type __setusermatherr _get_initial_narrow_environment _initterm _initterm_e _exit _set_fmode __p___argc __p___argv atof _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _free_dbg strcpy_s strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s wcscpy_s _rotl strcpy strcmp toupper sqrtf fmodf ceilf fabs qsort malloc free __stdio_common_vsscanf __stdio_common_vsprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func _wassert strncpy strncmp log acosf sinf _c_exit floorf _callnewh strlen lround

Name

.textbss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

598KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RustNewRecoil.exe

kernel32

user32

gdi32

advapi32

d3d9

imm32

dwmapi

msvcp140d

setupapi

vcruntime140d

vcruntime140_1d

ucrtbased

generic