Open-source atomic malware analysis

Analyze another

33ec6eb0b04a3f34b3aea302f64a26b08f5784d26fd30c7102a9505eef1e0c20

PE
Verdict: HOSTILE
AI Rust Socket.IO RAT with surveillance capabilities
Mal-ecule
K₂(McLi)O₄(CCa₂Co₂Dy)H₁₀(Cm₆Cr₂Db₃DsF₈Hf₂MgOs₁₄Po₈Ti)Md(Bi)
Size 2.7 MB download
First seen 16 days ago
Analyzed 15 days ago
Source virussign.com
Also detected by 2 sources
Socket.IO command agent with multiple collection surfaces: virussign.com_26b23f27e8410e190c24d2c9466871f0.vir:0x210f6c
virussign.com_26b23f27e8410e190c24d2c9466871f0.vir pe
0x210eec 01000000180000000000000008000000 ................
0x210efc 000000002d1f0c4001000000bc3d0040 ....-..@.....=.@
0x210f0c 01000000b36f0c400100000003700c40 .....o.@.....p.@
0x210f1c 010000002e700c4001000000433a5c55 .....p.@....C:\U
0x210f2c 736572735c636f726e695c2e63617267 sers\corni\.carg
0x210f3c 6f5c72656769737472795c7372635c69 o\registry\src\i
0x210f4c 6e6465782e6372617465732e696f2d31 ndex.crates.io-1
0x210f5c 3934396366386336623562353537665c 949cf8c6b5b557f\
0x210f6c 727573745f736f636b6574696f2d302e rust_socketio-0.Rust RAT key label collector
0x210f7c 352e305c7372635c6173796e6368726f 5.0\src\asynchro
0x210f8c 6e6f75735c636c69656e745c636c6965 nous\client\clie
0x210f9c 6e742e72730000000000000028272140 nt.rs.......('!@
0x210fac 01000000790000000000000092010000 ....y...........
0x210fbc 46000000282721400100000079000000 F...('!@....y...
0x210fcc 00000000b00100003500000028272140 ........5...('!@
0x210fdc 0100000079000000000000008c000000 ....y...........
0x210fec 3e000000282721400100000079000000 >...('!@....y...
0x210ffc 00000000970000000900000028272140 ............('!@
0x21100c 01000000790000000000000097000000 ....y...........
0x21101c 31000000282721400100000079000000 1...('!@....y...
0x21102c 00000000c30000002500000028272140 ........%...('!@
0x21103c 010000007900000000000000ca010000 ....y...........
0x21104c 41000000282721400100000079000000 A...('!@....y...
0x21105c 00000000b80100004800000052656365 ........H...Rece
0x21106c 6976656420616e20436f6e6e65637445 ived an ConnectE
0x21107c 72726f72206672616d653a20224e6f20 rror frame: "No
0x21108c 6572726f72206d657373616765207072 error message pr
0x21109c 6f766964656422000000000001000000 ovided".........
0x2110ac 00000080000000000000000000000000 ................
0x2110bc 00000000282721400100000079000000 ....('!@....y...
0x2110cc 00000000f00100004b00000003000000 ........K.......
0x2110dc 00000080000000000000000000000000 ................
0x2110ec 00000000040000000000008000000000 ................
0x2110fc 00000000000000000000000028272140 ............('!@
0x21110c 010000007900000000000000f6000000 ....y...........
0x21111c 05000000282721400100000079000000 ....('!@....y...
0x21112c 00000000610000003600000028272140 ....a...6...('!@
0x21113c 0100000079000000000000007b010000 ....y.......{...
0x21114c 59000000282721400100000079000000 Y...('!@....y...
0x21115c 000000001e0200004200000028272140 ........B...('!@
0x21116c 01000000790000000000000021020000 ....y.......!...
0x21117c 33000000282721400100000079000000 3...('!@....y...
0x21118c 000000006e0000003c0000002f736f63 ....n...<.../soc
0x21119c 6b65742e696f2f433a5c55736572735c ket.io/C:\Users\
0x2111ac 636f726e695c2e636172676f5c726567 corni\.cargo\reg
0x2111bc 69737472795c7372635c696e6465782e istry\src\index.
0x2111cc 6372617465732e696f2d313934396366 crates.io-1949cf
0x2111dc 386336623562353537665c727573745f 8c6b5b557f\rust_
0x211320 df720140010000000291024001000000 .r.@.......@....
0x211330 00000000000000000000000000000000 ................
0x211340 01000000000000003574014001000000 ........5t.@....
0x211350 6795024001000000d6b4014001000000 g..@.......@....
0x211360 08000000000000000800000000000000 ................
0x211370 b7700140010000002993024001000000 .p.@....)..@....
0x211380 00000000000000000000000000000000 ................
0x211390 0100000000000000696f014001000000 ........io.@....
0x2113a0 fa910240010000000000000000000000 ...@............
0x2113b0 00000000000000000100000000000000 ................
0x2113c0 7f740140010000005a94024001000000 .t.@....Z..@....
0x2113d0 00000000000000000000000000000000 ................
0x2113e0 0100000000000000c76d014001000000 .........m.@....
0x2113f0 07940240010000000000000000000000 ...@............
0x211400 00000000000000000100000000000000 ................
0x211410 9572014001000000a293024001000000 .r.@.......@....
0x211420 00000000000000000000000000000000 ................
0x211430 01000000000000004873014001000000 ........Hs.@....
0x211440 ab950240010000000000000000000000 ...@............Socket.IO command agent with multiple collection surfaces
0x211450 00000000000000000100000000000000 ................
0x211460 01720140010000003890024001000000 .r.@....8..@....
0x211470 40692640010000007200000000000000 @i&@....r.......
0x211480 56000000540000004069264001000000 V...T...@i&@....
0x211490 7200000000000000410000003c000000 r.......A...<...
0x2114a0 40692640010000007200000000000000 @i&@....r.......
0x2114b0 2a0000002f000000025b22c003222c22 *.../....["..","
0x2114c0 c002225d00025b22c002222cc0015d00 .."]..["..",..].
0x2114d0 58492640010000006700000000000000 XI&@....g.......
0x2114e0 6700000001000000433a5c5573657273 g.......C:\Users
0x2114f0 5c636f726e695c2e636172676f5c7265 \corni\.cargo\re
0x211500 6769737472795c7372635c696e646578 gistry\src\index
0x211510 2e6372617465732e696f2d3139343963 .crates.io-1949c
0x211520 66386336623562353537665c746f6b69 f8c6b5b557f\toki
0x211530 6f2d74756e677374656e6974652d302e o-tungstenite-0.
0x211540 32302e315c7372635c746c732e727300 20.1\src\tls.rs.
0x211550 e82c2140010000006700000000000000 .,!@....g.......
0x211560 3000000009000000e82c214001000000 0........,!@....
0x211570 67000000000000009900000009000000 g...............
0x211580 e82c2140010000006700000000000000 .,!@....g.......
0x211590 c000000001000000433a5c5573657273 ........C:\Users
0x2115a0 5c636f726e695c2e636172676f5c7265 \corni\.cargo\re
0x2115b0 6769737472795c7372635c696e646578 gistry\src\index
0x2115c0 2e6372617465732e696f2d3139343963 .crates.io-1949c
0x2115d0 66386336623562353537665c746f6b69 f8c6b5b557f\toki
0x2115e0 6f2d74756e677374656e6974652d302e o-tungstenite-0.
0x2115f0 32302e315c7372635c636f6e6e656374 20.1\src\connect
0x211600 2e72730000000000982d214001000000 .rs......-!@....
0x211610 6b000000000000001200000001000000 k...............
0x212ac8 7444656e696564506172616d65746572 tDeniedParameter
0x212ad8 4f75744f6652616e67654e6f74414461 OutOfRangeNotADa
0x212ae8 7461626173654661696c656420627569 tabaseFailed bui
0x212af8 6c64696e67207468652052756e74696d lding the Runtim
0x212b08 657372635c6d61696e2e727300000000 esrc\main.rs....
0x212b18 09432140010000000b00000000000000 .C!@............
0x212b28 ba0000000a0000000943214001000000 .........C!@....
0x212b38 0b000000000000001b00000005000000 ................
0x212b48 617574685f7665726966696564657865 auth_verifiedexeRust Socket.IO RAT control channel
0x212b58 637574655f636f6d6d616e6466696c65 cute_commandfile
0x212b68 5f616374696f6e7461736b5f61637469 _actiontask_acti
0x212b78 6f6e7574696c6974795f616374696f6e onutility_action
0x212b88 696e7465726163745f616374696f6e6e interact_actionn
0x212b98 6f74696669636174696f6e5f61637469 otification_acti
0x212ba8 6f6e73657474696e67735f616374696f onsettings_actio
0x212bb8 6e636c6970626f6172645f616374696f nclipboard_actio
0x212bc8 6e616476616e6365645f616374696f6e nadvanced_action
0x212bd8 73747265616d5f616374696f6e617564 stream_actionaud
0x212be8 696f5f616374696f6e00000000000000 io_action.......
0x212bf8 09432140010000000b00000000000000 .C!@............
0x212c08 ac00000005000000686f73746e616d65 ........hostname
0x212c18 09432140010000000b00000000000000 .C!@............
0x212c28 bd0000002e000000636c69656e745f69 ........client_i
0x212c38 646370755f70657263656e746d656d6f dcpu_percentmemo
0x212c48 72795f70657263656e746f6e6c696e65 ry_percentonline
0x212c58 68656172746265617400000000000000 heartbeat.......
0x212c68 09432140010000000b00000000000000 .C!@............
0x212c78 ac0000001200000009 .........
0x217e82 7064667372635c68616e646c6572735c pdfsrc\handlers\
0x217e92 696e746572616374696f6e2e72730073 interaction.rs.s
0x217ea2 687574646f776e5f7063726573746172 hutdown_pcrestar
0x217eb2 745f70636c6f636b5f7063736c656570 t_pclock_pcsleep
0x217ec2 5f7063626c6f636b5f696e707574756e _pcblock_inputun
0x217ed2 626c6f636b5f696e707574686964655f block_inputhide_
0x217ee2 6465736b746f7073686f775f6465736b desktopshow_desk
0x217ef2 746f706765745f77696669636d642f43 topget_wificmd/C
0x217f02 6e6574736820776c616e2073686f7720 netsh wlan show Socket.IO command agent with multiple collection surfaces
0x217f12 70726f66696c65730000000000000097 profiles........
0x217f22 21400100000002000000000000000297 !@..............
0x217f32 21400100000018000000000000001157 !@.............W
0x217f42 492d46492050524f46494c45533a0a0a I-FI PROFILES:..
0x217f52 c0000000000085962140010000001b00 ........!@......
0x217f62 00000000000041000000350000007365 ......A...5...se
0x217f72 7474696e67735f6d73675368656c6c5f ttings_msgShell_
0x217f82 54726179576e640050726f676d616e00 TrayWnd.Progman.
0x217f92 72756e646c6c33322e65786575736572 rundll32.exeuser
0x217fa2 33322e646c6c2c4c6f636b576f726b53 32.dll,LockWorkS
0x217fb2 746174696f6e9e972140010000001a00 tation..!@......
0x217fc2 00000000000073687574646f776e2f72 ......shutdown/r
0x217fd2 2f7400000000d0972140010000000200 /t......!@......
0x217fe2 000000000000d2972140010000000200 ........!@......
0x217ff2 000000000000d86f2640010000000100 .......o&@......
0x218002 0000000000002f730000000000000898 ....../s........
0x218012 2140010000000200 !@......
0x218773 40010000001400000000000000240000 @............$..
0x218783 002e00000070726f6365737365737461 .....processesta
0x218793 736b5f726573706f6e73650000509f21 sk_response..P.!
0x2187a3 40010000001400000000000000050000 @...............
0x2187b3 004600000053595354454d0000509f21 .F...SYSTEM..P.!
0x2187c3 40010000001400000000000000180000 @...............
0x2187d3 000d0000006d656d6f72795f6d625275 .....memory_mbRu
0x2187e3 6e6e696e676372656174655f74696d65 nningcreate_time
0x2187f3 7372635c68616e646c6572735c62726f src\handlers\broRust Socket.IO surveillance RAT
0x218803 777365722e7273000000000000f39f21 wser.rs........!
0x218813 40010000001700000000000000120000 @...............
0x218823 0028000000f39f214001000000170000 .(.....!@.......
0x218833 00000000000c00000041000000f39f21 .........A.....!
0x218843 40010000001700000000000000450000 @............E..
0x218853 002d0000006c6f67696e7362726f7773 .-...loginsbrowsRust Chromium login collection
0x218863 65725f646174615553455250524f4649 er_dataUSERPROFI
0x218873 4c456368726f6d656564676514252511 LEchromeedge.%%.
0x218883 34213409193a36343909183c36273a26 4!4..:649..<6':&
0x218893 3a332109103132300900263027751134 :3!..120..&0'u.4
0x2188a3 2134091130333420392109193a323c3b !4..034 9!..:2<;
0x2188b3 7511342134c0015cc000142525113421 u.4!4..\...%%.4!
0x2188c3 3409193a36343909123a3a3239300916 4..:649..::290..
0x2188d3 3d273a38300900263027751134213409 =':80..&0'u.4!4.
0x2188e3 1130333420392109193a323c3b751134 .034 9!..:2<;u.4
0x2188f3 213464625f746d702e64617406101910 !4db_tmp.dat....
0x218903 1601753436213c3a3b0a202739797520 ..u46!<:;. '9yu
0x218913 2630273b3438300a2334392030797525 &0';480.#49 0yu%
0x218923 342626223a27310a2334392030751307 4&&":'1.#49 0u..
0x218933 1a1875393a323c3b2600000000f39f21 ..u9:2<;&......!
0x218943 40010000001700000000000000370000 @............7..
0x218953 003200000075736572706173735b454e .2...userpass[EN
0x218963 435259505445445d636f6d6d616e6473 CRYPTED]commands
0x218973 72635c68616e646c6572735c636f6d6d rc\handlers\comm
0x218983 616e642e7273007368656c6c10202020 and.rs.shell.
0x218993 3e20457865637574696e67205bc0035d > Executing [..]
0x2189a3 3a20c0010a0011457865637574696f6e : .....Execution
0x2189b3 204572726f723a20c000112020203e20 Error: ... >
0x2189c3 4f7574707574206c656e3a20c0072063 Output len: .. c
0x2189d3 686172730a000000000000000072a121 hars.........r.!
0x2189e3 40010000001700000000000000250000 @............%..
0x2189f3 00300000006f75747075747465726d69 .0...outputtermi
0x218a03 6e616c5f6f757470757400000072a121 nal_output...r.!
0x218a13 40010000001700000000000000060000 @...............
0x218a23 004a0000007372635c73657276696365 .J...src\service
0x218a33 735c617564696f2e727300000028a221 s\audio.rs...(.!
0x218a43 400100000015000000000000004c0000 @............L..
0x218a53 00350000000d417564696f204572726f .5....Audio Erro
0x218a63 723a20c0010a0000000000000028a221 r: ..........(.!

Well-known

Objectives

Micro-behaviors

Metadata

20 of 52 traits shown

Identity

SHA-256 33ec6eb0b04a3f34b3aea302f64a26b08f5784d26fd30c7102a9505eef1e0c20
Filename virussign.com_26b23f27e8410e190c24d2c9466871f0.vir
Package 33ec6eb0b04a3f34b3aea302f64a26b08f5784d26fd30c7102a9505eef1e0c20

Origin

Source harvest
Feed virussign
Domain virussign.com

Timeline

First seen 9 Aug 2026 13:11 UTC
First analyzed 10 Aug 2026 07:52 UTC
Last analyzed 10 Aug 2026 07:52 UTC
Last updated 10 Aug 2026 07:52 UTC

Labeling

Label bad
Label source harvest
Traits version 46d16