rustup-init[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rustup-init.exe
Size 12.1MB
Sample260930-mpf3laxzcw
SHA256 6f4bef66261261fcb43131be8720bab817d403a09edec7455c371974b90bdb7e
MD5 b147221215f594041ddb4a583ba63f5a
SHA1 b36e70f54ebe5d0b3b4eb3b700b847b802fe7b36
SHA512 3127a0aaafa4959ccd01b8b2579d478280095d6ce908ea461b4a297ea7af9beac6770bd2555530b536be491d5eca490706ac1ef14d61afee67ec9a84967ab16d
SSDEEP 98304:UkKjHueMNY0FloeUb3eXzVp+DOJb2s8PaX8h3dYBFoIvOji9/zRj+7Ma43LiVRLt:/LweUbO1gVh3dYBFoIvOjiJRjW7Y6
TLSH
T1D3D628117A9B99ECD0AAC874834A4A735A2170DB0B36B9FF40D456393F6ABE05F3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rustup-init.exe

File Explorer

rustup-init.exe

.exe 12.1MB

rustup-init.exe

IMPHASH 2e7bc4f5f8c5912a5e00bb47e4746c2c
SHA256 6f4bef66261261fcb43131be8720bab817d403a09edec7455c371974b90bdb7e
MD5 b147221215f594041ddb4a583ba63f5a
SHA1 b36e70f54ebe5d0b3b4eb3b700b847b802fe7b36
SHA512 3127a0aaafa4959ccd01b8b2579d478280095d6ce908ea461b4a297ea7af9beac6770bd2555530b536be491d5eca490706ac1ef14d61afee67ec9a84967ab16d
SSDEEP 98304:UkKjHueMNY0FloeUb3eXzVp+DOJb2s8PaX8h3dYBFoIvOji9/zRj+7Ma43LiVRLt:/LweUbO1gVh3dYBFoIvOjiJRjW7Y6
TLSH
T1D3D628117A9B99ECD0AAC874834A4A735A2170DB0B36B9FF40D456393F6ABE05F3D314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8850400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rustup_init.pdb

bcryptprimitives

ProcessPrng

kernel32

CancelIoEx WriteFile SetFileCompletionNotificationModes HeapReAlloc GetSystemInfo GetCurrentProcessId CreateFileW DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetOverlappedResult ReadFile CreateJobObjectW SetInformationJobObject GetCurrentProcess AssignProcessToJobObject GetSystemTimePreciseAsFileTime HeapSize SetEndOfFile SwitchToThread GetModuleHandleA TerminateProcess GetExitCodeProcess SleepEx ReadFileEx GetFileInformationByHandle MoveFileExW SetConsoleCtrlHandler IsProcessInJob QueryInformationJobObject SetStdHandle CreateToolhelp32Snapshot Process32First Process32Next OpenProcess GetFileSizeEx GetCurrentThreadId SetLastError WaitForSingleObjectEx CreateMutexA ReleaseMutex GetConsoleOutputCP LoadLibraryExW WriteConsoleW WriteFileEx IsProcessorFeaturePresent SetHandleInformation SetFileTime GetFullPathNameW PeekNamedPipe ReadConsoleW CreateEventW LockFileEx LoadLibraryExA ExitProcess CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW GetQueuedCompletionStatusEx WaitForMultipleObjects GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW CreateSymbolicLinkW CreateHardLinkW CreateWaitableTimerExW SetWaitableTimer Sleep GetFileType GetDriveTypeW GetModuleHandleExW FindNextFileW FlsFree FlsSetValue FlsGetValue GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive FlsAlloc GetStartupInfoW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeSListHead GetSystemTimeAsFileTime FreeLibrary VirtualQuery VirtualProtect FindFirstFileExW DuplicateHandle MoveFileExA CreateThread WaitForSingleObject VerSetConditionMask VerifyVersionInfoW FormatMessageW GetLastError SetFileInformationByHandle SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetFileInformationByHandleEx HeapAlloc CloseHandle HeapFree SetFilePointerEx InitializeConditionVariable LocalFree LoadLibraryA GetProcessHeap FindClose GetProcAddress WakeConditionVariable SleepConditionVariableCS InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue LoadLibraryW FlushFileBuffers CreateDirectoryW SetDefaultDllDirectories GetStdHandle SetThreadStackGuarantee GetModuleHandleW GetCurrentThread GetConsoleMode GetNativeSystemInfo SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode RtlUnwind GetTimeZoneInformation GetStringTypeW SetEnvironmentVariableW GetCPInfo AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetOEMCP GetCurrentDirectoryW lstrlenW WideCharToMultiByte GetACP MultiByteToWideChar IsValidCodePage LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime EncodePointer RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter RaiseException GetEnvironmentVariableW GetEnvironmentVariableA FormatMessageA GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceCounter QueryPerformanceFrequency

advapi32

RegDeleteTreeW CryptReleaseContext RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA

oleaut32

SysStringLen SysFreeString

ws2_32

getaddrinfo freeaddrinfo WSAStartup recv send WSASend getsockopt connect htons ntohs socket shutdown setsockopt WSASetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAIoctl WSAWaitForMultipleEvents closesocket __WSAFDIsSet getpeername select htonl accept WSASocketW ioctlsocket bind listen getsockname WSAGetLastError WSACleanup

crypt32

CertGetNameStringA CertFindExtension CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA CertFindCertificateInStore CertEnumCertificatesInStore CertDuplicateCertificateContext PFXImportCertStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddEncodedCertificateToStore CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateChain CertGetCertificateChain CertCloseStore CertDuplicateStore CertAddCertificateContextToStore CertFreeCertificateContext

ole32

CoCreateInstance CoInitializeEx

ntdll

NtCreateNamedPipeFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtOpenFile RtlNtStatusToDosError RtlInitUnicodeString NtCreateFile NtReadFile

shell32

SHGetKnownFolderPath ShellExecuteW

combase

CoTaskMemFree

secur32

DecryptMessage ApplyControlToken FreeContextBuffer InitSecurityInterfaceA AcquireCredentialsHandleA FreeCredentialsHandle AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW EncryptMessage DeleteSecurityContext

user32

SendMessageTimeoutA

iphlpapi

if_nametoindex

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

332KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rustup-init.exe

bcryptprimitives

kernel32

advapi32

oleaut32

ws2_32

crypt32

ole32

ntdll

shell32

combase

secur32

user32

iphlpapi

generic