client-rust(2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
client-rust(2).exe
Size 12.6MB
Sample260913-plergaxake
SHA256 b02d28fc97b5f43dae22b8b6bd313c5ebb98cfa7e899126af6cc321a06cb9f7c
MD5 cdeca2a3a560b94c1d01e58b8cef1d12
SHA1 fcc764a759ba355edf87631995d6fd113da21f6e
SHA512 28cf57b6c3d240bd1a3a63745b17493460b17fb0ab1b12aef9bd6020a7df42a15e877e9ffe52ee3e02f0944fd5ead9fa27385178dfdc6c151c96a97f92ad6ded
SSDEEP 98304:mTBlGJVlAzOuvZ4dJjK+KunH3MVgiyeoBg0cWL/Cr6y+shWPShA5kQ/VQ1LURQjP:mTumK0NaFxyrQSCFE
TLSH
T15BD66DD3A10908ADC667C63F897B862EA77533813B6677E78D4C4D3AAF066C18F19344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client-rust(2).exe

File Explorer

client-rust(2).exe

.exe 12.6MB

client-rust(2).exe

IMPHASH d238890398519d3b6ce4382df1108e17
SHA256 b02d28fc97b5f43dae22b8b6bd313c5ebb98cfa7e899126af6cc321a06cb9f7c
MD5 cdeca2a3a560b94c1d01e58b8cef1d12
SHA1 fcc764a759ba355edf87631995d6fd113da21f6e
SHA512 28cf57b6c3d240bd1a3a63745b17493460b17fb0ab1b12aef9bd6020a7df42a15e877e9ffe52ee3e02f0944fd5ead9fa27385178dfdc6c151c96a97f92ad6ded
SSDEEP 98304:mTBlGJVlAzOuvZ4dJjK+KunH3MVgiyeoBg0cWL/Cr6y+shWPShA5kQ/VQ1LURQjP:mTumK0NaFxyrQSCFE
TLSH
T15BD66DD3A10908ADC667C63F897B862EA77533813B6677E78D4C4D3AAF066C18F19344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SystemFunction036 GetUserNameW

bcrypt

BCryptGenRandom

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsThreadAFiber LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SleepEx SwitchToThread TlsAlloc TlsFree UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW CancelIoEx CloseHandle ConnectNamedPipe CreateIoCompletionPort DisconnectNamedPipe DuplicateHandle GetComputerNameW GetCurrentProcess GetDiskFreeSpaceExW GetNamedPipeInfo GetOverlappedResult GetQueuedCompletionStatusEx OpenProcess PostQueuedCompletionStatus ReadFile RegisterWaitForSingleObject SetFileCompletionNotificationModes SetHandleInformation Sleep TerminateProcess TlsGetValue TlsSetValue UnregisterWaitEx WriteFile DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtOpenFile NtReadFile NtWriteFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

CloseClipboard EmptyClipboard GetClipboardData GetDC GetSystemMetrics OpenClipboard ReleaseDC SetClipboardData SetCursorPos keybd_event mouse_event

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSAStartup freeaddrinfo getaddrinfo select WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW accept bind closesocket connect getpeername getsockname getsockopt ioctlsocket listen recv recvfrom send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

586KB

Virtual Size

586KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client-rust(2).exe

advapi32

bcrypt

gdi32

iphlpapi

kernel32

ntdll

ole32

shell32

user32

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic