# New Rust-Based Infostealer Distributed via Cracked Software Evades Analysis and Sandboxes (AhnLab ASEC)

> AhnLab ASEC reports a new, unnamed Rust-based infostealer distributed disguised as illegal/cracked software. It uses anti-disassembly, CPU-cache-based VM/sandbox detection and encrypted strings, runs via AutoIt, Explorer process injection or standalone, steals credentials, certificates, SSH keys and documents from many application classes, and can download additional malware.

- **Published:** 2026-10-21T08:55:56Z
- **Last reviewed:** 2026-10-21T08:55:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4026
- **ID:** TL-2026-4026
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab's ASEC team describes a new type of infostealer written in Rust and distributed disguised as illegal (cracked) software. ASEC first detected it in mid-August 2026, when it was spread on a small scale and executed through AutoIt, a Windows automation scripting tool. From early September 2026 large-scale distribution began, in forms that run through AutoIt, by injection into the Windows Explorer process, or as a standalone executable. A separate downloader has also been observed delivering the infostealer. ASEC's detection guidance includes watching for users downloading large ZIP files from untrusted sources, decompressing them and running the contained executables.

The malware is built to resist analysis. ASEC documents anti-disassembly via dynamic JMP instructions, and anti-sandbox techniques that use CPU memory cache lookups. Internal strings are encrypted and decrypted only at the moment of use, using modified Base64 index tables that are rotated, with decryption keys that differ per sample; arbitrary data is appended to encrypted strings to obscure their original length. When a VM or sandbox is detected the sample displays "I love stealing cookies, but not on this machine. Sorry!" and terminates without running its payload (the reason for the report's title: behavior changes when the sample is observed). In the Explorer-injection form, an encrypted DLL is decrypted and injected into explorer.exe.

For command and control, ASEC reports that outbound data is XOR-encrypted and then LZNT1-compressed, and inbound data is XOR-decrypted before use, with different XOR keys per sample to evade traffic analysis. The C2 returns configuration data that determines the collection scope. The stealer targets web browsers, instant messengers, email clients, password managers, note-taking applications, VPNs, remote access programs, database management tools, FTP and SSH tools, cloud storage, AI and development tools, cryptocurrency wallets and gaming platforms. It also collects certificates, SSH keys, wallet files, configuration files and documents.

The malware also acts as a dropper: it downloads and executes additional malware from URLs specified by the C2, and ASEC confirmed from configuration data that this feature is enabled. The article names no malware family, threat actor, CVE, hashes, domains or IPs; ASEC withholds IOCs behind its AhnLab TIP subscription. Severity is an analyst estimate, not a source-stated rating.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.010 AutoHotKey & AutoIT
- T1055.001 Dynamic-link Library Injection
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1036 Masquerading
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1552.004 Private Keys
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560.003 Archive via Custom Method
- T1132 Data Encoding

## Sources

- [Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer (AhnLab ASEC)](https://asec.ahnlab.com/en/95937/)
- [May 2025 Infostealer Trend Report (AhnLab ASEC) - related context on infostealers distributed as cracked software](https://asec.ahnlab.com/en/88476/)
- [August 2025 Infostealer Trend Report (AhnLab ASEC) - related context](https://asec.ahnlab.com/en/90154/)
- [Demystifying Myth Stealer: A Rust-Based Infostealer (Trellix) - related Rust stealer, not the same malware](https://www.trellix.com/en-in/blogs/research/demystifying-myth-stealer-a-rust-based-infostealer/)
- [Rust-Based Info Stealers Abuse GitHub Codespaces (Trend Micro) - related Rust stealer context, not the same malware](https://trendmicro.com/en_se/research/23/e/rust-based-info-stealers-abuse-github-codespaces.html)
- [MITRE ATT&CK T1497.001 Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4026