New Rust Infostealer Evades Sandboxes and Can Deploy Additional Malware
Summary
AhnLab reports a Rust infostealer distributed as pirated software that uses sandbox evasion and process injection, steals data based on C2 instructions, and can download additional malware.
Key points
- The malware was first detected in mid-August; distribution expanded in September as execution shifted from AutoIt to process injection or standalone execution.
- It terminates without stealing data when it detects a sandbox or virtual environment, and uses dynamic JMPs and encrypted strings to hinder analysis.
- It collects infected-PC details and follows C2-provided configuration to target browser, business, development, remote-access, and other applications, as well as files such as certificates and SSH keys.
- C2 traffic uses XOR encryption and LZNT1 compression; XOR key values vary between samples.
- The malware can download and execute another payload from a URL specified in its C2 configuration; AhnLab says this capability was enabled in analyzed configuration data.
- AhnLab advises using legitimate software sources and checking for suspicious downloads, process injection, C2 communications, information theft, and additional malware.
Article Details
- Attack Vectors
- The infostealer was distributed disguised as illegal or cracked software; some samples were executed through a separate downloader.
- Some organizations may encounter the malware after users download and run executables contained in ZIP files from untrusted sources.
- The malware can download and execute an additional payload from an external URL specified in C2-provided settings.
- Defensive Notes
- Download software from trusted sources, such as official websites, and avoid opening compressed files or executables from unknown sources.
- Check for histories of downloading large ZIP files from untrusted sources, extracting them, and running the contained executables.
- Monitor for abnormal code injection involving AutoIt.Exe or explorer.Exe, communication with suspicious C2 servers, information theft, and installation of additional malware.
- Use endpoint security solutions to monitor suspicious process execution and external communications, and strengthen threat detection and response.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware encrypts its internal strings and uses sample-specific modified index tables and appended arbitrary strings to hinder analysis.T1041 · Exfiltration Over C2 ChannelThe malware transmits collected infected-PC information to its C2 server.T1055 · Process InjectionThe malware injects code into the Windows Explorer process; some samples decrypt an internally stored DLL and inject it into Explorer.T1082 · System Information DiscoveryOn execution, the infostealer collects host information including the CPU name, graphics driver information, CPUID data, and Windows version.T1105 · Ingress Tool TransferThe infostealer can connect to an external URL specified in C2-provided settings to download and execute an additional payload.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypts internal strings immediately before use and decrypts an internally stored encrypted DLL before injection.T1497.001 · System ChecksThe malware checks for sandbox or virtual environments and terminates without stealing information when it detects one.T1518 · Software DiscoveryThe malware collects a list of installed programs from the infected PC.