Answer Brief
AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
AhnLab publishes its technical analysis detailing the malware's evasion techniques, C2 configuration, and dropper capabilities.
Executive Summary: AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads.
Why It Matters
Security researchers at AhnLab have identified a new type of information theft malware developed in the Rust programming language that masquerades as illegal software and cracked programs. According to AhnLab's analysis, the malware was first observed in mid-August undergoing small-scale test distributions before shifting execution methods and spreading widely in early September. The threat presents a compound risk because it combines broad data collection targeting personal and corporate credentials with the capability to act as a dropper for secondary malware infections.
The initial distribution in mid-August relied on AutoIt, a legitimate Windows automation scripting tool, to carry out small-scale distributions. As the campaign transitioned to large-scale distribution in early September, the operators shifted their execution methods toward standalone execution or process injection, specifically injecting the malware into the legitimate Windows Explorer process (explorer.exe). Some samples also utilized a separate downloader to fetch the final executable, illustrating the changing execution pipeline across distribution waves.
Technical Signal
A key focus of AhnLab's technical report is the malware's deliberate design to defeat static analysis, automated sandboxes, and reverse engineering. Written in Rust, the payload employs anti-disassembly mechanisms based on dynamic JMPs to disrupt machine code decompilation. To detect virtual analysis environments, it inspects CPU memory cache lookups. When an isolated sandbox or virtual machine is detected, the malware immediately terminates its execution without stealing data, displaying a dialogue box that reads: "I love stealing cookies, but not on this machine. Sorry!"
String obfuscation within the binary also exhibits notable complexity. All internally referenced strings remain encrypted until immediately prior to execution. Decryption relies on a modified Base64 index table whose internal structure varies across samples. The table undergoes an additional transformation at runtime by rotating based on an integer passed to the decryption routine. Furthermore, the operators append arbitrary padding strings to the end of the encrypted strings to hinder external analysts from estimating original string lengths.
Operational Impact
Upon successful execution outside an analysis environment, the malware collects initial host telemetry to send to an attacker-controlled command-and-control (C2) server. Telemetry transmitted includes the CPU name, CPUID data, graphics driver information, the Windows operating system version, and an inventory of installed programs. Communication with the C2 infrastructure combines Windows LZNT1 compression with XOR encryption, where the specific XOR key values vary per sample to prevent uniform network signature detection.
The C2 server responds with configuration data defining the specific theft modules and operational parameters. AhnLab found that the scope of theft targets is expansive, encompassing personal and enterprise digital assets. Monitored categories include web browsers, instant messaging clients, email applications, password managers, and note-taking utilities. Crucially, the target list also covers work tools, including VPNs, remote access applications, database management suites, FTP, and SSH clients, alongside development environments, cloud storage, AI tools, and cryptocurrency wallets.
What To Watch
Beyond extracting stored credentials, the configuration targets direct filesystem artifacts, including digital certificates, private SSH keys, configuration files, document files, and wallet data.
AhnLab also confirmed that the malware possesses dropper capabilities, with its remote configuration explicitly enabling features to download and run secondary payloads from external URLs. Consequently, the infection vector exposes victims to risks beyond initial data exfiltration, serving as a beachhead for further malicious deployments inside the infected host's operational environment.
To counter this activity, AhnLab advises organizations and users to avoid downloading cracked or unauthorized software, monitor for unauthorized downloads of large archives, and inspect processes for anomalous code injection into AutoIt or Windows Explorer. Security teams are urged to track execution of unverified binaries, observe external C2 communications, and ingest published indicators of compromise into their endpoint detection systems.
Event Type: security
Importance: high
Affected Companies
- AhnLab
Affected Sectors
- cybersecurity
- software
Timeline
- AhnLab publishes its technical analysis detailing the malware's evasion techniques, C2 configuration, and dropper capabilities.
Frequently Asked Questions
How is this newly identified infostealer distributed?
The malware is distributed disguised as illegal software or cracked programs. AhnLab observed that some instances are executed via a separate downloader, with earlier versions using AutoIt and later campaigns using process injection or standalone execution.
What anti-analysis techniques does the Rust-based malware employ?
The malware implements anti-disassembly using dynamic JMPs, CPU memory cache lookups for anti-sandbox detection, encrypted strings using rotating modified index tables, and DLL injection into the Windows Explorer process.
What happens when the infostealer detects a sandbox or virtual machine?
If the malware determines that it is executing inside a sandbox or virtual environment, it terminates without performing information theft, displaying a message stating: 'I love stealing cookies, but not on this machine. Sorry!'
What information does the malware target for exfiltration?
Configured targets include web browsers, email clients, password managers, VPN and remote access tools, cloud storage, AI and development tools, cryptocurrency wallets, certificates, SSH keys, configuration files, and document files.
Can this infostealer perform actions beyond data theft?
Yes. Configuration data confirmed the malware functions as a dropper, connecting to an external URL specified by the C2 server to download and execute additional malicious payloads on infected systems.