kaandemir993/rusty-stealer-keylogger-screen-streaming-service-persistence-defender-evasion-analysisReverse engineering Rusty Stealer: A Rust-based RAT featuring advanced keylogging, live screen streaming, and aggressive defense evasion (killing Windows Defender and hijacking services) to maintain persistence.
The initial reverse engineering of the Rusty Stealer sample in Ghidra reveals a dedicated keylogger module compiled in Rust. The decompiled view clearly shows the malware hooking into user input by resolving keycodes and mapping them to specific actions. This confirms the stealer actively logs keystrokes to harvest credentials, chats, and sensitive user data.
Keylogger Logic (Pseudo-C view): FUN_140020ffe(&Var29, pHVar44, "key_press", 9) – dynamically resolves the "key_press" event string. Condition checks for specific keys: "Enter", "Escape", "Esc", "Tab", "Backspace", "Back". *HKEY__ pHVar37 = ... – registry handle resolution (potentially reading keyboard layout or persistence) Assembly View (Disassembly): LEA R8, [local_4a8] / MOV qword ptr [R8], RAX – loads the key event structure into memory. CALL FUN_140020ffe – main key-processing function. JZ LAB_14000f309 – conditional jumps based on key codes (checking for specific keys).
Active Keystroke Capture: The explicit checks for "Enter", "Tab", "Backspace", etc., prove the malware logs every keystroke, including special keys, to reconstruct passwords and messages. Registry Interaction: The HKEY__ handle suggests the keylogger might be reading system configurations or storing its logs in the registry. Credential Harvesting: Logging "key_press" events alongside window titles (seen in later stages) allows the attacker to map keystrokes to specific applications (e.g., browsers, banking apps).
The second Ghidra decompilation view of Rusty Stealer reveals a capability that pushes it beyond a standard info-stealer into RAT (Remote Access Trojan) territory. The malware includes routines for screen capture and live streaming, allowing the attacker to visually monitor the victim’s desktop in real-time, in addition to stealing files and keystrokes.
Screen Capture Logic: FUN_140020ffe(..., "screen_stream", 0xd) – explicitly initializes the screen streaming module. FUN_14000d9eb7("fps", 3, ...) – sets a frame rate (FPS) for the live stream, likely to balance CPU usage and video quality. FUN_14000c87a(..., "done", 4) / FUN_14000c87a(..., "streaming", 9) – state markers for start/stop streaming operations. Memory & Buffer Management: if (uVar69 < 5) { uVar47 = uVar69; } – internal buffering logic for screen frames. Assembly References (Cross-References): LEA R8, [s_screen_stream_14001592a] – loads the "screen_stream" string into memory for comparison. CALL FUN_140020ffe – main handler for streaming logic.
Live Surveillance: The "screen_stream" and "fps" strings prove the malware can live-stream the victim's screen. This is a hallmark of full-fledged RATs (like njRAT or Quasar), not just simple stealers. Data Exfiltration (Visual): While keyloggers grab text, screen streaming captures banking sessions, crypto wallets, and private messages visually — bypassing encryption entirely. Resource Optimization: Setting a specific FPS (e.g., 3 FPS) means the malware is designed to run silently in the background without alerting the user through high CPU usage.
The third decompiled view of Rusty Stealer exposes highly aggressive defense evasion and session hijacking routines. The malware includes specific functions to kill Windows Defender and hijack active network/streaming sessions (likely to intercept traffic or disrupt security monitoring). This confirms Rusty Stealer is designed not just to steal data, but to actively blind security tools.
Windows Defender Killed: FUN_140020ffe(..., "kill_defender", 0xd) – dynamically resolves the string to terminate Defender processes. FUN_14001add55() – likely the execution routine that forcibly stops Defender services or processes. Stream Hijacking: FUN_140020ffe(..., "hijack_stream", 0xc) – resolves the logic to hijack active streams (network traffic or screen-sharing). Memory Manipulation & Execution: MOVUPS xmmword ptr [R12] / MOVUPS xmmword ptr [RDX + local_550] – SIMD instructions used for rapid memory copying (likely preparing shellcode or stream buffers). CALL FUN_14000d55() – executes the hijack or kill routine.
Blinding the Defender: kill_defender proves the stealer actively targets Windows' built-in security. If successful, it disables real-time protection, allowing the rest of the malware (keylogger, screen streamer) to operate without interference. Session Hijacking: hijack_stream suggests the malware can intercept or take over active network streams. This could be used to steal live session cookies, intercept banking transactions, or disrupt remote administration tools. Evasion by Design: The presence of error_pinned shows the malware anticipates defenses where critical processes cannot be terminated. It likely retries or switches techniques.
The fourth decompiled view of Rusty Stealer exposes its system reconnaissance module. Before stealing data or exfiltrating files, the malware gathers detailed information about the victim's machine, including hostname, username, operating system version, and local/external IP addresses. This profiling data is likely sent to the C2 server to categorize the victim and tailor the next stage of the attack.
System Profiling Strings:
"hostname" – retrieves the victim's computer name. "username" – retrieves the logged-in user account. "os_ver" – captures the exact Windows version and build. "local_ip" – identifies the victim's internal network IP address. "external_ip" – resolves the public IP address (likely via an external API). "stream_id" – generates a unique identifier for the screen streaming session.
Decompiled Logic:
FUN_1400084d2(uStack_570, "hostname", 8, ...) – stores the hostname in a structure.
FUN_1400084d2(uStack_570, "username", 8, ...) – stores the username.
FUN_1400084d2(uStack_570, "os_ver", 6, ...) – stores the OS version.
FUN_1400084d2(uStack_570, "local_ip", 8, ...) / "external_ip" – stores network identifiers.
Memory Structures: HKEY__ *local_588 / CONCAT71(local_588, 0x7f, 1) – registry-related pointer handling (likely reading system identifiers). FUN_140010ce1(..., local_3e8, ...) – final assembly of the profiling data.
Victim Categorization: Collecting os_ver and external_ip allows the attacker to filter victims (e.g., targeting specific countries, corporate networks, or Windows versions vulnerable to specific exploits). Geo-Location & Tracking: The external_ip field enables the attacker to geolocate the victim and determine their ISP. Session Management: The stream_id links the profiling data to the active screen-streaming session, ensuring the attacker knows which victim they are viewing.
