rustrust | 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764

Sharing

Copy URL Twitter E-mail

General

Target
5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764
Size 1.5MB
Sample260910-lep23san4s
SHA256 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764
MD5 3c3fd9cd6a4bc0d223970bc7d7341269
SHA1 b0643668907ff3f9faeb428380cc2bb20dc3b604
SHA512 e57c18623bd5bf7f209d2d741145e03fe5510051a08ed0e1e39ed240bf45a1016e26c660418996b499fbafa274a47e11546f0828d046b2dadaf85fc5f8a132f1
SSDEEP 24576:4OSrj1gx/lE7koZZr7XDYy7xsVfPD/LX5JxcfcGh0v1G:4jrj+dE7koZZrrT7xsFLLXxcfc6I1
TLSH
T134659E17F3A840ECD067C275C6069617EB72B84A2B30AADF52D54A5A3F27AB15F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer rustrust

Malware Config

Signatures

Family: RUSTRUST
Rustrust is a Windows stealer written in Rust.
stealer rustrust

Detect RUSTRUST stealer 1 IoCs

resource	yara_rule
sample	family_rustrust

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764

File Explorer

5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764

.exe 1.5MB

5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764

IMPHASH 1ad1842f1ef67f9067e79ea0ab46019b
SHA256 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764
MD5 3c3fd9cd6a4bc0d223970bc7d7341269
SHA1 b0643668907ff3f9faeb428380cc2bb20dc3b604
SHA512 e57c18623bd5bf7f209d2d741145e03fe5510051a08ed0e1e39ed240bf45a1016e26c660418996b499fbafa274a47e11546f0828d046b2dadaf85fc5f8a132f1
SSDEEP 24576:4OSrj1gx/lE7koZZr7XDYy7xsVfPD/LX5JxcfcGh0v1G:4jrj+dE7koZZrrT7xsFLLXxcfc6I1
TLSH
T134659E17F3A840ECD067C275C6069617EB72B84A2B30AADF52D54A5A3F27AB15F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect RUSTRUST stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1158672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rustrust.pdb

crypt32

CryptUnprotectData

kernel32

CloseHandle FindClose DeleteFileW GetLastError SetFileInformationByHandle CopyFileExW GetFileInformationByHandleEx SwitchToThread QueryPerformanceFrequency LocalFree SetFilePointerEx FindNextFileW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW QueryPerformanceCounter CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle GetSystemTimePreciseAsFileTime CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetCommandLineW GetTempPathW GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW GetSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx RtlPcToFileHeader ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter GetTimeZoneInformation VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764

crypt32

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

generic