typeentityconfidencelowcreated2026-06-21updated2026-06-21rustloaderdropperc2process-injectionmasqueradepe
unclassified-rust-dropper-2024
Single observed sample (n=1). A Rust x64 PE dropper using tokio/reqwest/hyper to fetch a remote .bin payload over HTTPS, stage itself to C:\Users\Public\Libraries\, and inject the downloaded bytes via NtWriteVirtualMemory/NtCreateThreadEx. Masquerades as an industrial shipping RFQ with fabricated version info (Nova Fusion / immortal pulsar).
Overview
- First seen: 2024-07-23 (PE timestamp)
- Sample:
RFQ_New_Order_-_57m³_LPG_SEMI_TRAILER_7_NOS.exe
- SHA-256:
f97c10fc536d51ec0bd21c6b7195b562d267d2a1b604ff19ffd01894f8fcf5e8
- Platform: Windows x64 PE32+
- Size: 1.69 MB
- Packing: None
- Signing: None
Build Stack
| Component |
Version / Detail |
| Language |
Rust |
| Linker |
MSVC 14.40 (VS 2022) |
| Async runtime |
tokio 1.36.0 |
| HTTP client |
reqwest 0.11.27 + hyper 0.14.28 + h2 0.3.25 |
| TLS backend |
schannel 0.1.23 (Windows native TLS) |
| Crypto |
bcrypt, base64-0.21.7, rand-0.8.5 |
| Build host |
C:\Users\Administrator (local Windows dev host) |
| PDB |
immortal_pulsar.pdb |
Capabilities
https-payload-fetchself-staging-public-librariesscheduled-task-persistencedesktop-file-enumerationntdll-process-injectionversion-info-masquerade
Deploy / TTPs
| ATT&CK ID |
Technique |
Evidence |
| T1566.001 |
Spearphishing Attachment |
Industrial RFQ filename lure |
| T1053.005 |
Scheduled Task/Job |
Error registering task: string |
| T1105 |
Ingress Tool Transfer |
https://nc.bmexcellentfocus.net/...bin |
| T1055 |
Process Injection |
NtWriteVirtualMemory, NtCreateThreadEx imports |
| T1083 |
File and Directory Discovery |
User's desktop file count: |
| T1071.001 |
Application Layer Protocol: Web |
reqwest + hyper + schannel |
| T1497.001 |
Virtualization/Sandbox Evasion |
quan.suning.com/getSysTime.do time sync |
| T1036.005 |
Masquerading |
Nova Fusion / immortal pulsar version info |
Notable Analyses
- /intel/analyses/f97c10fc536d51ec0bd21c6b7195b562d267d2a1b604ff19ffd01894f8fcf5e8.html — Deep static dive (this analysis)
Related
- rust-async-rat-framework — Cross-family concept page documenting the recurring Rust + tokio + reqwest/hyper builder pattern
- dolphin — Full-featured Rust RAT sharing the same async stack but with WebSocket C2 and polymorphic morph