{"id":"2d4fe10deb30092875ad0e5327904cd9","title":"Rust RAT/Infostealer — Rust RAT/Infostealer · 木马/恶意软件 · PE64","md5":"2d4fe10deb30092875ad0e5327904cd9","sha256":"07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a","family":"Rust RAT/Infostealer","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Rust","file_format":"PE64","compiler":"Rust(MSVC)","published_at":"2026-08-06T16:00:00.000Z","summary":"该样本为 Rust 编译的 Windows x86-64 远程访问木马(RAT)与信息窃取器(Infostealer)混合型恶意软件。具备 TLS 1.3 加密 C2 通信、浏览器凭证窃取(Chrome/Firefox/IE)、反向 Shell、文件上传下载、注册表持久化、IP 地理定位侦察、屏幕枚举、SendInput 远程控制模拟等完整功能链。通过 Rust 静态链接特性隐藏大部分 API 导入，仅 kernel32.dll 可见。内置 IsDebuggerPresent 反调试检测，使用互斥体确保单实例运行。无明确 C2 IP/域名硬编码，疑似通过命令行参数或配置文件动态指定。","url":"https://zseceye.com/report/2d4fe10deb30092875ad0e5327904cd9","json_url":"https://zseceye.com/report/2d4fe10deb30092875ad0e5327904cd9.json","html_url":"https://zseceye.com/report/2d4fe10deb30092875ad0e5327904cd9","hash_urls":{"md5":"https://zseceye.com/hash/2d4fe10deb30092875ad0e5327904cd9","sha256":"https://zseceye.com/hash/07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a"},"search_urls":{"md5":"https://zseceye.com/?q=2d4fe10deb30092875ad0e5327904cd9","sha256":"https://zseceye.com/?q=07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a"},"sample_download_url":"https://zseceye.com/report/2d4fe10deb30092875ad0e5327904cd9/sample","sample_filename":"07b1a32c53c1efab.zip","iocs":[],"ips":[]}