Procedure examples

RustyWater has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.

RustyWater has encrypted all strings in the code using position independent XOR encryption.

RustyWater has gathered the victim machine’s username.

RustyWater has used reddit.exe as its file name and a Cloudflare logo.

RustyWater has injected its shellcode into explorer.exe by allocating memory via `VirtualAllocEx`, then by writing the payload via `WriteProcessMemory`.

RustyWater has used the Rust request library for HTTP C2 communication.

RustyWater has gathered the victim machine’s computer name.

RustyWater has gathered the domain membership of the victim machine’s user.

RustyWater has used `CreateObject` to instantiate a WScript.Shell Component Object Model (COM) object.  Additionally, RustyWater has used `VirtualAllocEx` and `WriteProcessMemory` to inject shellcode into explorer.exe.

RustyWater has encoded collected data with Base64.

RustyWater has used the WriteHexToFile function to transform an embedded hex string to the payload CertificationKit.ini.

RustyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

RustyWater has attempted to detect more than 25 antivirus and EDR tools.

RustyWater has established persistence by adding `C:\ProgramData\CertificationKit.ini` to a Windows startup Registry key or to a Run or RunOnce Registry key.

RustyWater has used a WScript.Shell COM object to execute the CertificationKit.ini file.

RustyWater has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.

RustyWater has encrypted encoded data with XOR before sending it to the C2 server.

RustyWater has registered a Vectored Exception Handler (VEH) to catch debugging efforts.

RustyWater has generated random sleep intervals between C2 communication.

RustyWater has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain `info@tmcell`.