client-rust(5)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
client-rust(5).exe
Size 18.0MB
Sample260919-rtfpvaswdt
SHA256 778b307929f1d87aa1f64b0784881d369ccbd6c7f9aa80262105300d7028ce10
MD5 40d703702dffedd5593c8eb9d81fb0f8
SHA1 a636a4836483e9e0404faf38eeaeb1e6bda9e4e6
SHA512 095237506d55f09abc97221d201080afc96fa7a969a66dba514ca777043d6e75dc4ad581422d472d4f55da92185c49ab004047d68c6bf2c7884c1eaba5365d24
SSDEEP 98304:EP4TiCCUDQcdPsVyqFtN/r+JeG4vB6U17U1Nz+s0rNpWoKApglsiWQfVcjHRFrvF:UDNq9g5Ujz6rNpWoKRlsndvF
TLSH
T136178E83E50208E9C153C63B492F363EF6743B5C77A4A6E79C484E3A9F5A6D18F06748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client-rust(5).exe

File Explorer

client-rust(5).exe

.exe 18.0MB

client-rust(5).exe

IMPHASH 58a87fc5165355d49546bd7a380b86e2
SHA256 778b307929f1d87aa1f64b0784881d369ccbd6c7f9aa80262105300d7028ce10
MD5 40d703702dffedd5593c8eb9d81fb0f8
SHA1 a636a4836483e9e0404faf38eeaeb1e6bda9e4e6
SHA512 095237506d55f09abc97221d201080afc96fa7a969a66dba514ca777043d6e75dc4ad581422d472d4f55da92185c49ab004047d68c6bf2c7884c1eaba5365d24
SSDEEP 98304:EP4TiCCUDQcdPsVyqFtN/r+JeG4vB6U17U1Nz+s0rNpWoKApglsiWQfVcjHRFrvF:UDNq9g5Ujz6rNpWoKRlsndvF
TLSH
T136178E83E50208E9C153C63B492F363EF6743B5C77A4A6E79C484E3A9F5A6D18F06748
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW SystemFunction036 CreateProcessAsUserW GetUserNameW

bcrypt

BCryptGenRandom

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsThreadAFiber LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetWaitableTimer SleepEx SwitchToThread TlsAlloc TlsFree UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW CancelIoEx ConnectNamedPipe CreateIoCompletionPort DisconnectNamedPipe DuplicateHandle GetCurrentProcess GetNamedPipeInfo GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile RegisterWaitForSingleObject SetFileCompletionNotificationModes SetHandleInformation UnregisterWaitEx WriteFile CheckRemoteDebuggerPresent CloseHandle CreateEventW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection GetComputerNameW GetCurrentThread GetDiskFreeSpaceExW GetSystemInfo GetThreadContext GetTickCount GetTickCount64 GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection OpenProcess Process32FirstW Process32NextW RaiseException RtlUnwindEx SetEvent SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject __C_specific_handler

ntdll

NtOpenFile NtReadFile NtWriteFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateNamedPipeFile NtQueryInformationProcess

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

CloseClipboard EmptyClipboard GetClipboardData GetDC GetSystemMetrics OpenClipboard ReleaseDC SendInput SetClipboardData SetCursorPos keybd_event mouse_event

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSAStartup freeaddrinfo getaddrinfo select WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW accept bind closesocket connect getpeername getsockname getsockopt ioctlsocket listen recv recvfrom send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

536KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

573KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

409KB

Virtual Size

408KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/95

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/111

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/127

Size

456KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/140

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client-rust(5).exe

advapi32

bcrypt

gdi32

iphlpapi

kernel32

ntdll

ole32

shell32

user32

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

wtsapi32

generic