s/gakonstMALWARE CAMPAIGNS•Oct 13
116
votes
3.3k
seen
Rust malware records zero detections across every public sandbox tested
A Rust malware sample has evaded every public-facing sandbox tested so far. The campaign uses SVG attachments to push recipients toward RAR archives disguised with the .REV extension, continuing a pattern of compromised email accounts spreading the payload.
The sample checks CPU instructions and its environment for signs of emulation, then offers command-line and GUI variants and mutates its payloads. One related Go sample contacted 85.192.30.227, while the Rust sample recorded zero detections in static analysis, dynamic analysis, and public sandbox emulation.
The sample checks CPU instructions and its environment for signs of emulation, then offers command-line and GUI variants and mutates its payloads. One related Go sample contacted 85.192.30.227, while the Rust sample recorded zero detections in static analysis, dynamic analysis, and public sandbox emulation.
Timeline3
Oct 11
A Go-based malware sample was observed arriving through a VBS loader and a ZIP archive masquerading as legitimate software.
Oct 12
A Go sample was found inside a RAR archive disguised as a .REV file, using an SVG document to direct recipients toward further downloads and propagation.
Oct 13
A Rust sample was reported performing CPU and emulation checks and evading every public-facing sandbox tested.
1 comment
Oct 13