MAL-2026-19200: Malicious code in basek (crates.io)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63) basek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed getdata() routine polls Windows key states for alphanumeric, function, and special keys and batches captured keystrokes together with the local username. The batches are POSTed to the Telegram Bot API at api.telegram.org/bot<token>/sendMessage using a bot token stored as a byte array XORed with 0xAA and reassembled at runtime via the ut! macro, with hardcoded chatid 7304091279; a secondary exfiltration endpoint https://keylogger.nullsect0r.tech/log is also configured. The crate installs itself for persistence: ensureinstalled() copies the host binary to %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, writes an HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value named 'WinSysUtils' for boot persistence, spawns a watchdog clone under a random 12-digit filename to respawn the keylogger, and schedules a cmd.exe timeout+del sequence to self-delete the original. A 30-second initial sleep, a 20-second warmup during which keystrokes are observed but not logged, and randomized polling jitter are used to evade sandbox and behavioral analysis. The crate description's 'educational cybersecurity project' framing is contradicted by the XOR-obfuscated exfiltration destination, hardcoded attacker chatid, Run-key persistence, watchdog respawn, and self-delete logic.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the keylogging and persistence behavior?
The described behavior targets Windows. It polls Windows key states and uses %LOCALAPPDATA% plus the current user's HKCU Run registry key for installation and boot persistence.
What execution is required for the malicious activity to occur?
The crate's behavior is implemented in routines including get_data() for key capture and ensure_installed() for persistence. A Windows binary that includes and executes those routines would be able to collect keystrokes, install persistence, and attempt exfiltration.
What artifacts can be used to investigate a suspected compromise?
Look for %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe and an HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value named WinSysUtils. The malware may also create a watchdog clone with a random 12-digit filename and use cmd.exe timeout and delete commands to remove the original binary.
Where does the captured data go?
Captured keystroke batches and the local username are sent to the Telegram Bot API using a hardcoded chat_id of 7304091279. A secondary endpoint at https://keylogger.nullsect0r.tech/log is also configured.