Extracted

• • Target
    Client.exe
  • Size 548KB
  • SHA256 285eeaf46e455ad7a4405c71c404750a6882e7718e31cf2ba9636ad79d147384
  • MD5 06a1882cfb40365ca45ad2bbd9dac240
  • SHA1 a51c6d0781939958574ca0d463f1316267f48e12
  • SHA512 09ad5e5bb008bc0689be6610048d23eec51df3738427d0cef734a161f641ace87b2b1e4d161c6136d0328183684543adf210be42345efb5e4418c31beae376e2
  • SSDEEP 6144:vv2yBCYf1VoGfExk1sYJe6VlWT8b9ho7XQfNbwKCrHJ3KtEBibwulsctNq:vv2NgVoCLJPVle8twKCrHyEQ5
  • TLSH
    T10FC4B41DFD81F805CE2A3EB3CFEA10049B7121C16E2195462159AFFD87A63B358E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_nbszmiyxtaxexecutionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence

    persistence

  • Sheetrat family

    sheetrat

  • Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1