- AhnLab ASEC reports a Rust infostealer spread as pirated software that exits without stealing when it detects a sandbox or virtual machine.
- Its configuration targets VPNs, SSH keys, certificates and AI tools, and it can download more malware, so stolen access could reach company systems.
- AhnLab advises checking for ZIP-then-run downloads, code injection involving AutoIt.exe or explorer.exe, and suspicious command-server traffic.
A thief that behaves when it is watched
Security teams learn how malware works by running it in a controlled lab and watching. A new infostealer, described by AhnLab's ASEC research team on October 20, is built to defeat that method. When it decides it is in a lab, it stops and takes nothing.
The lesson is simple. With malware like this, a lab shows you only what the author allows. A clean test result tells you less than it appears to.
What AhnLab found
AhnLab says it first detected the malware in mid-August, disguised as illegal software. Some copies were launched by a separate downloader. The early releases were small, which AhnLab presumes were tests. They used AutoIt, a Windows automation scripting tool.
The method then changed. The malware began injecting itself into the Windows Explorer process, or ran standalone. After that shift, AhnLab saw it spread at a much larger scale from early September.
The report gives no victim counts. It does not name the group behind the malware or say how many organisations were hit.
How it hides
AhnLab says the malware is written in Rust. It then describes several layers of concealment.
First, it uses dynamic jumps to disrupt disassembly, the step where analysts turn machine code back into readable instructions. Second, it checks CPU memory cache behaviour to detect a sandbox, an isolated analysis environment. Third, in some recent samples, it decrypts a DLL stored inside itself and injects it into Explorer.
If it concludes it is in a sandbox or virtual machine, it exits without stealing anything. Before it quits, AhnLab reports, it pops up a message saying it likes stealing cookies, "but not on this machine."
Its internal text is also scrambled. Strings are stored encrypted and decrypted only just before use. The decoding table differs from sample to sample, and it is altered again each time the function is called. Random characters are added to hide string length.
Network traffic is disguised too. Data sent to the attacker's command server is encrypted with XOR, then compressed with LZNT1, a Windows compression algorithm. The XOR key differs per sample. AhnLab presumes this is meant to evade detection based on network traffic.
What it goes after
On first run, the malware sends the attacker a profile of the PC. This includes installed programs, the CPU name, graphics driver details and the Windows version. The command server then replies with settings that decide what to steal.
In the configuration AhnLab confirmed, the target list is broad. It covers browsers, messengers, email clients, password managers and note-taking apps. It also lists VPNs, remote access programs, database tools, and FTP and SSH tools. Cloud storage, AI and development tools, crypto wallets and gaming platforms are on it as well.
It also seeks certificates, SSH keys, configuration files and documents. AhnLab notes that the real scope may vary with the settings the server sends.
The malware can also act as a dropper, meaning it downloads and runs further malware from a URL in its settings. AhnLab confirmed that this feature was enabled in the configuration it analysed.
Why a pirated download becomes a company problem
This is the view of WebPulse, not a finding in the report. The target list mixes personal and work items. Alongside browsers, messengers, password managers and crypto wallets, it includes VPN logins, SSH keys and certificates. The work items are what turn a personal infection into a company risk.
AhnLab warns that stolen VPN or remote access credentials could be used to reach a company's internal systems or launch further attacks. A single infected machine can therefore become a company's exposure, whether or not the company ever approved the software.
The evasion also changes what defenders can rely on. Because the launch method changed over time, AhnLab advises looking beyond specific files to abnormal code injection inside legitimate processes.
Questions to put to your security team
AhnLab recommends several checks. Look for a history of large ZIP files downloaded from untrusted sources, unpacked, and then run. Look for abnormal code injection involving AutoIt.exe or explorer.exe. Look for contact with suspicious command servers and signs of data theft or extra malware.
Leaders can turn those into direct questions.
Can we see when someone unpacks an archive from an untrusted source and runs what is inside? Do our endpoint tools flag code injected into Explorer, not just known bad files? If a machine ran cracked software, do we know which VPN, SSH and cloud credentials were stored on it, and can we replace them quickly? Does our testing rely on sandbox results that this kind of malware is designed to defeat?
A thief that leaves when someone is watching teaches one thing. Watching is not the same as seeing.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: AhnLab ASEC.
