A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker ransomware to a single developer. The infostealer exfiltrates cryptocurrency wallets, browser credentials, Office documents, and VPN configurations. The HVNC tool enables hidden remote desktop sessions and implements AMSI and ETW evasion techniques. Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS. Multiple droppers written in C, Rust, and PowerShell were discovered delivering the malicious payloads. Build timestamps indicated development occurred within weeks, and infrastructure leaked evidence of additional tools including FUD-Crypter, Botnet, and C2 Agent components, demonstrating how overlooked compilation artifacts enable comprehensive attribution and threat mapping.

Indicators of Compromise

• ip: 93.152.223.30
• hash: d222549235db4112333d82e12f767d47
• hash: 12463a81a786b04fe4b3b7d1aa1222e589e5921d
• hash: 178f890f62db90738b11300dd272537240b1c8a599d2ebeccdea01654811fed0
• hash: 278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a
• hash: 6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5
• hash: 6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53
• hash: 7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6
• hash: abd43578b135df61f49844087af0b372ae10b2f27721ad6ba09710760ab0b240
• hash: d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
• hash: f9964a8d9d01052d9bebe057deadd7ce9d794e8296e2a72229f8ae4aa62ae224
• hash: fad8f76afec90c888b4a739539deae250320fd49c34ef8458833b356ea9b7767
• ip: 93.152.220.87