AI
Rust Socket.IO RAT with surveillance capabilities
Local reference
Suspicious dependency
Inferred
Rust Socket.IO surveillance RAT: virussign.com_26b23f27e8410e190c24d2c9466871f0.vir:0x210f6c
Socket.IO command agent with multiple collection surfaces: virussign.com_26b23f27e8410e190c24d2c9466871f0.vir:0x210f6c
Rust Chromium login collection: virussign.com_26b23f27e8410e190c24d2c9466871f0.vir:0x210f6c
| 0x210eec | 01000000180000000000000008000000 | ................ |
| 0x210efc | 000000002d1f0c4001000000bc3d0040 | ....-..@.....=.@ |
| 0x210f0c | 01000000b36f0c400100000003700c40 | .....o.@.....p.@ |
| 0x210f1c | 010000002e700c4001000000433a5c55 | .....p.@....C:\U |
| 0x210f2c | 736572735c636f726e695c2e63617267 | sers\corni\.carg |
| 0x210f3c | 6f5c72656769737472795c7372635c69 | o\registry\src\i |
| 0x210f4c | 6e6465782e6372617465732e696f2d31 | ndex.crates.io-1 |
| 0x210f5c | 3934396366386336623562353537665c | 949cf8c6b5b557f\ |
| 0x210f6c | 727573745f736f636b6574696f2d302e | rust_socketio-0.Rust RAT key label collector |
| 0x210f7c | 352e305c7372635c6173796e6368726f | 5.0\src\asynchro |
| 0x210f8c | 6e6f75735c636c69656e745c636c6965 | nous\client\clie |
| 0x210f9c | 6e742e72730000000000000028272140 | nt.rs.......('!@ |
| 0x210fac | 01000000790000000000000092010000 | ....y........... |
| 0x210fbc | 46000000282721400100000079000000 | F...('!@....y... |
| 0x210fcc | 00000000b00100003500000028272140 | ........5...('!@ |
| 0x210fdc | 0100000079000000000000008c000000 | ....y........... |
| 0x210fec | 3e000000282721400100000079000000 | >...('!@....y... |
| 0x210ffc | 00000000970000000900000028272140 | ............('!@ |
| 0x21100c | 01000000790000000000000097000000 | ....y........... |
| 0x21101c | 31000000282721400100000079000000 | 1...('!@....y... |
| 0x21102c | 00000000c30000002500000028272140 | ........%...('!@ |
| 0x21103c | 010000007900000000000000ca010000 | ....y........... |
| 0x21104c | 41000000282721400100000079000000 | A...('!@....y... |
| 0x21105c | 00000000b80100004800000052656365 | ........H...Rece |
| 0x21106c | 6976656420616e20436f6e6e65637445 | ived an ConnectE |
| 0x21107c | 72726f72206672616d653a20224e6f20 | rror frame: "No |
| 0x21108c | 6572726f72206d657373616765207072 | error message pr |
| 0x21109c | 6f766964656422000000000001000000 | ovided"......... |
| 0x2110ac | 00000080000000000000000000000000 | ................ |
| 0x2110bc | 00000000282721400100000079000000 | ....('!@....y... |
| 0x2110cc | 00000000f00100004b00000003000000 | ........K....... |
| 0x2110dc | 00000080000000000000000000000000 | ................ |
| 0x2110ec | 00000000040000000000008000000000 | ................ |
| 0x2110fc | 00000000000000000000000028272140 | ............('!@ |
| 0x21110c | 010000007900000000000000f6000000 | ....y........... |
| 0x21111c | 05000000282721400100000079000000 | ....('!@....y... |
| 0x21112c | 00000000610000003600000028272140 | ....a...6...('!@ |
| 0x21113c | 0100000079000000000000007b010000 | ....y.......{... |
| 0x21114c | 59000000282721400100000079000000 | Y...('!@....y... |
| 0x21115c | 000000001e0200004200000028272140 | ........B...('!@ |
| 0x21116c | 01000000790000000000000021020000 | ....y.......!... |
| 0x21117c | 33000000282721400100000079000000 | 3...('!@....y... |
| 0x21118c | 000000006e0000003c0000002f736f63 | ....n...<.../soc |
| 0x21119c | 6b65742e696f2f433a5c55736572735c | ket.io/C:\Users\ |
| 0x2111ac | 636f726e695c2e636172676f5c726567 | corni\.cargo\reg |
| 0x2111bc | 69737472795c7372635c696e6465782e | istry\src\index. |
| 0x2111cc | 6372617465732e696f2d313934396366 | crates.io-1949cf |
| 0x2111dc | 386336623562353537665c727573745f | 8c6b5b557f\rust_ |
| 0x211320 | df720140010000000291024001000000 | .r.@.......@.... |
| 0x211330 | 00000000000000000000000000000000 | ................ |
| 0x211340 | 01000000000000003574014001000000 | ........5t.@.... |
| 0x211350 | 6795024001000000d6b4014001000000 | g..@.......@.... |
| 0x211360 | 08000000000000000800000000000000 | ................ |
| 0x211370 | b7700140010000002993024001000000 | .p.@....)..@.... |
| 0x211380 | 00000000000000000000000000000000 | ................ |
| 0x211390 | 0100000000000000696f014001000000 | ........io.@.... |
| 0x2113a0 | fa910240010000000000000000000000 | ...@............ |
| 0x2113b0 | 00000000000000000100000000000000 | ................ |
| 0x2113c0 | 7f740140010000005a94024001000000 | .t.@....Z..@.... |
| 0x2113d0 | 00000000000000000000000000000000 | ................ |
| 0x2113e0 | 0100000000000000c76d014001000000 | .........m.@.... |
| 0x2113f0 | 07940240010000000000000000000000 | ...@............ |
| 0x211400 | 00000000000000000100000000000000 | ................ |
| 0x211410 | 9572014001000000a293024001000000 | .r.@.......@.... |
| 0x211420 | 00000000000000000000000000000000 | ................ |
| 0x211430 | 01000000000000004873014001000000 | ........Hs.@.... |
| 0x211440 | ab950240010000000000000000000000 | ...@............Socket.IO command agent with multiple collection surfaces |
| 0x211450 | 00000000000000000100000000000000 | ................ |
| 0x211460 | 01720140010000003890024001000000 | .r.@....8..@.... |
| 0x211470 | 40692640010000007200000000000000 | @i&@....r....... |
| 0x211480 | 56000000540000004069264001000000 | V...T...@i&@.... |
| 0x211490 | 7200000000000000410000003c000000 | r.......A...<... |
| 0x2114a0 | 40692640010000007200000000000000 | @i&@....r....... |
| 0x2114b0 | 2a0000002f000000025b22c003222c22 | *.../....[".."," |
| 0x2114c0 | c002225d00025b22c002222cc0015d00 | .."]..["..",..]. |
| 0x2114d0 | 58492640010000006700000000000000 | XI&@....g....... |
| 0x2114e0 | 6700000001000000433a5c5573657273 | g.......C:\Users |
| 0x2114f0 | 5c636f726e695c2e636172676f5c7265 | \corni\.cargo\re |
| 0x211500 | 6769737472795c7372635c696e646578 | gistry\src\index |
| 0x211510 | 2e6372617465732e696f2d3139343963 | .crates.io-1949c |
| 0x211520 | 66386336623562353537665c746f6b69 | f8c6b5b557f\toki |
| 0x211530 | 6f2d74756e677374656e6974652d302e | o-tungstenite-0. |
| 0x211540 | 32302e315c7372635c746c732e727300 | 20.1\src\tls.rs. |
| 0x211550 | e82c2140010000006700000000000000 | .,!@....g....... |
| 0x211560 | 3000000009000000e82c214001000000 | 0........,!@.... |
| 0x211570 | 67000000000000009900000009000000 | g............... |
| 0x211580 | e82c2140010000006700000000000000 | .,!@....g....... |
| 0x211590 | c000000001000000433a5c5573657273 | ........C:\Users |
| 0x2115a0 | 5c636f726e695c2e636172676f5c7265 | \corni\.cargo\re |
| 0x2115b0 | 6769737472795c7372635c696e646578 | gistry\src\index |
| 0x2115c0 | 2e6372617465732e696f2d3139343963 | .crates.io-1949c |
| 0x2115d0 | 66386336623562353537665c746f6b69 | f8c6b5b557f\toki |
| 0x2115e0 | 6f2d74756e677374656e6974652d302e | o-tungstenite-0. |
| 0x2115f0 | 32302e315c7372635c636f6e6e656374 | 20.1\src\connect |
| 0x211600 | 2e72730000000000982d214001000000 | .rs......-!@.... |
| 0x211610 | 6b000000000000001200000001000000 | k............... |
| 0x212ac8 | 7444656e696564506172616d65746572 | tDeniedParameter |
| 0x212ad8 | 4f75744f6652616e67654e6f74414461 | OutOfRangeNotADa |
| 0x212ae8 | 7461626173654661696c656420627569 | tabaseFailed bui |
| 0x212af8 | 6c64696e67207468652052756e74696d | lding the Runtim |
| 0x212b08 | 657372635c6d61696e2e727300000000 | esrc\main.rs.... |
| 0x212b18 | 09432140010000000b00000000000000 | .C!@............ |
| 0x212b28 | ba0000000a0000000943214001000000 | .........C!@.... |
| 0x212b38 | 0b000000000000001b00000005000000 | ................ |
| 0x212b48 | 617574685f7665726966696564657865 | auth_verifiedexeRust Socket.IO RAT control channel |
| 0x212b58 | 637574655f636f6d6d616e6466696c65 | cute_commandfile |
| 0x212b68 | 5f616374696f6e7461736b5f61637469 | _actiontask_acti |
| 0x212b78 | 6f6e7574696c6974795f616374696f6e | onutility_action |
| 0x212b88 | 696e7465726163745f616374696f6e6e | interact_actionn |
| 0x212b98 | 6f74696669636174696f6e5f61637469 | otification_acti |
| 0x212ba8 | 6f6e73657474696e67735f616374696f | onsettings_actio |
| 0x212bb8 | 6e636c6970626f6172645f616374696f | nclipboard_actio |
| 0x212bc8 | 6e616476616e6365645f616374696f6e | nadvanced_action |
| 0x212bd8 | 73747265616d5f616374696f6e617564 | stream_actionaud |
| 0x212be8 | 696f5f616374696f6e00000000000000 | io_action....... |
| 0x212bf8 | 09432140010000000b00000000000000 | .C!@............ |
| 0x212c08 | ac00000005000000686f73746e616d65 | ........hostname |
| 0x212c18 | 09432140010000000b00000000000000 | .C!@............ |
| 0x212c28 | bd0000002e000000636c69656e745f69 | ........client_i |
| 0x212c38 | 646370755f70657263656e746d656d6f | dcpu_percentmemo |
| 0x212c48 | 72795f70657263656e746f6e6c696e65 | ry_percentonline |
| 0x212c58 | 68656172746265617400000000000000 | heartbeat....... |
| 0x212c68 | 09432140010000000b00000000000000 | .C!@............ |
| 0x212c78 | ac0000001200000009 | ......... |
| 0x217e82 | 7064667372635c68616e646c6572735c | pdfsrc\handlers\ |
| 0x217e92 | 696e746572616374696f6e2e72730073 | interaction.rs.s |
| 0x217ea2 | 687574646f776e5f7063726573746172 | hutdown_pcrestar |
| 0x217eb2 | 745f70636c6f636b5f7063736c656570 | t_pclock_pcsleep |
| 0x217ec2 | 5f7063626c6f636b5f696e707574756e | _pcblock_inputun |
| 0x217ed2 | 626c6f636b5f696e707574686964655f | block_inputhide_ |
| 0x217ee2 | 6465736b746f7073686f775f6465736b | desktopshow_desk |
| 0x217ef2 | 746f706765745f77696669636d642f43 | topget_wificmd/C |
| 0x217f02 | 6e6574736820776c616e2073686f7720 | netsh wlan show Socket.IO command agent with multiple collection surfaces |
| 0x217f12 | 70726f66696c65730000000000000097 | profiles........ |
| 0x217f22 | 21400100000002000000000000000297 | !@.............. |
| 0x217f32 | 21400100000018000000000000001157 | !@.............W |
| 0x217f42 | 492d46492050524f46494c45533a0a0a | I-FI PROFILES:.. |
| 0x217f52 | c0000000000085962140010000001b00 | ........!@...... |
| 0x217f62 | 00000000000041000000350000007365 | ......A...5...se |
| 0x217f72 | 7474696e67735f6d73675368656c6c5f | ttings_msgShell_ |
| 0x217f82 | 54726179576e640050726f676d616e00 | TrayWnd.Progman. |
| 0x217f92 | 72756e646c6c33322e65786575736572 | rundll32.exeuser |
| 0x217fa2 | 33322e646c6c2c4c6f636b576f726b53 | 32.dll,LockWorkS |
| 0x217fb2 | 746174696f6e9e972140010000001a00 | tation..!@...... |
| 0x217fc2 | 00000000000073687574646f776e2f72 | ......shutdown/r |
| 0x217fd2 | 2f7400000000d0972140010000000200 | /t......!@...... |
| 0x217fe2 | 000000000000d2972140010000000200 | ........!@...... |
| 0x217ff2 | 000000000000d86f2640010000000100 | .......o&@...... |
| 0x218002 | 0000000000002f730000000000000898 | ....../s........ |
| 0x218012 | 2140010000000200 | !@...... |
| 0x218773 | 40010000001400000000000000240000 | @............$.. |
| 0x218783 | 002e00000070726f6365737365737461 | .....processesta |
| 0x218793 | 736b5f726573706f6e73650000509f21 | sk_response..P.! |
| 0x2187a3 | 40010000001400000000000000050000 | @............... |
| 0x2187b3 | 004600000053595354454d0000509f21 | .F...SYSTEM..P.! |
| 0x2187c3 | 40010000001400000000000000180000 | @............... |
| 0x2187d3 | 000d0000006d656d6f72795f6d625275 | .....memory_mbRu |
| 0x2187e3 | 6e6e696e676372656174655f74696d65 | nningcreate_time |
| 0x2187f3 | 7372635c68616e646c6572735c62726f | src\handlers\broRust Socket.IO surveillance RAT |
| 0x218803 | 777365722e7273000000000000f39f21 | wser.rs........! |
| 0x218813 | 40010000001700000000000000120000 | @............... |
| 0x218823 | 0028000000f39f214001000000170000 | .(.....!@....... |
| 0x218833 | 00000000000c00000041000000f39f21 | .........A.....! |
| 0x218843 | 40010000001700000000000000450000 | @............E.. |
| 0x218853 | 002d0000006c6f67696e7362726f7773 | .-...loginsbrowsRust Chromium login collection |
| 0x218863 | 65725f646174615553455250524f4649 | er_dataUSERPROFI |
| 0x218873 | 4c456368726f6d656564676514252511 | LEchromeedge.%%. |
| 0x218883 | 34213409193a36343909183c36273a26 | 4!4..:649..<6':& |
| 0x218893 | 3a332109103132300900263027751134 | :3!..120..&0'u.4 |
| 0x2188a3 | 2134091130333420392109193a323c3b | !4..034 9!..:2<; |
| 0x2188b3 | 7511342134c0015cc000142525113421 | u.4!4..\...%%.4! |
| 0x2188c3 | 3409193a36343909123a3a3239300916 | 4..:649..::290.. |
| 0x2188d3 | 3d273a38300900263027751134213409 | =':80..&0'u.4!4. |
| 0x2188e3 | 1130333420392109193a323c3b751134 | .034 9!..:2<;u.4 |
| 0x2188f3 | 213464625f746d702e64617406101910 | !4db_tmp.dat.... |
| 0x218903 | 1601753436213c3a3b0a202739797520 | ..u46!<:;. '9yu |
| 0x218913 | 2630273b3438300a2334392030797525 | &0';480.#49 0yu% |
| 0x218923 | 342626223a27310a2334392030751307 | 4&&":'1.#49 0u.. |
| 0x218933 | 1a1875393a323c3b2600000000f39f21 | ..u9:2<;&......! |
| 0x218943 | 40010000001700000000000000370000 | @............7.. |
| 0x218953 | 003200000075736572706173735b454e | .2...userpass[EN |
| 0x218963 | 435259505445445d636f6d6d616e6473 | CRYPTED]commands |
| 0x218973 | 72635c68616e646c6572735c636f6d6d | rc\handlers\comm |
| 0x218983 | 616e642e7273007368656c6c10202020 | and.rs.shell. |
| 0x218993 | 3e20457865637574696e67205bc0035d | > Executing [..] |
| 0x2189a3 | 3a20c0010a0011457865637574696f6e | : .....Execution |
| 0x2189b3 | 204572726f723a20c000112020203e20 | Error: ... > |
| 0x2189c3 | 4f7574707574206c656e3a20c0072063 | Output len: .. c |
| 0x2189d3 | 686172730a000000000000000072a121 | hars.........r.! |
| 0x2189e3 | 40010000001700000000000000250000 | @............%.. |
| 0x2189f3 | 00300000006f75747075747465726d69 | .0...outputtermi |
| 0x218a03 | 6e616c5f6f757470757400000072a121 | nal_output...r.! |
| 0x218a13 | 40010000001700000000000000060000 | @............... |
| 0x218a23 | 004a0000007372635c73657276696365 | .J...src\service |
| 0x218a33 | 735c617564696f2e727300000028a221 | s\audio.rs...(.! |
| 0x218a43 | 400100000015000000000000004c0000 | @............L.. |
| 0x218a53 | 00350000000d417564696f204572726f | .5....Audio Erro |
| 0x218a63 | 723a20c0010a0000000000000028a221 | r: ..........(.! |
Well-known
Objectives
Micro-behaviors
Metadata
20 of 52 traits shown
Identity
| SHA-256 | 33ec6eb0b04a3f34b3aea302f64a26b08f5784d26fd30c7102a9505eef1e0c20 |
|---|---|
| Filename | virussign.com_26b23f27e8410e190c24d2c9466871f0.vir |
| Package | 33ec6eb0b04a3f34b3aea302f64a26b08f5784d26fd30c7102a9505eef1e0c20 |
Origin
| Source | harvest |
|---|---|
| Feed | virussign |
| Domain | virussign.com |
Timeline
| First seen | 9 Aug 2026 13:11 UTC |
|---|---|
| First analyzed | 10 Aug 2026 07:52 UTC |
| Last analyzed | 10 Aug 2026 07:52 UTC |
| Last updated | 10 Aug 2026 07:52 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 46d16 |
Not seeing what you expected? Let us know