Extracted

Extracted

• • Target
    HoneInstall.exe
  • Size 3.1MB
  • SHA256 0913b5256877463810ffc10a0323da08b2d45b946ba008e372dc372769ac52bd
  • MD5 334e301ba0d86d864282bde98d64d2c3
  • SHA1 df57e0974be9582c8ca7c2addbbc66d1c26b023d
  • SHA512 e13511f8a092d30ea43ccd393b00cab1c8b0023831866db25a8a36b97eb7a8812327a36bc8817272339f6ea8df3c9a5fd3a96aabccc5879a3aaddd89517acc45
  • SSDEEP 98304:YW+ZawOV72AA1DwGDlcz+N6Uu3aEdKkP:YW+ZC2JDRQ+gUuKEd7
  • TLSH
    T1A8E5335602A5457ED7272FFABEF601AF5091E58943380ABCE9C1EB65383CD92438C52F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_ekktjanmuacollectiondiscoveryexecutionsheetratxbinderxwormloaderpersistenceprivilege_escalationratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence

    persistence

  • Sheetrat family

    sheetrat

  • Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Xbinder family

    xbinder

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1