Extracted

• • Target
    start.exe.exe
  • Size 301KB
  • SHA256 e831de437b3cf279bedf39ac3d1af2295503aa4a93f45d28c5c573b5210a602c
  • MD5 60a2ac8ed9f057a748625d8be9458444
  • SHA1 4515ecd7f90554e572233bf8d86bef21116b32ad
  • SHA512 82fe85ae6f686adf6da9ce8816a28c621c9e5f54b4381a95785c315892d626af103320e1aa14808500a052e4704f64dbfc3c28f4f3d556f3b8a1117c313e1e3e
  • SSDEEP 6144:rKq869LKHmH3flFcYxuNHIA/b5dO73jvCGz1boSNq:+qBOGv46wHIA/VGzvX1E
  • TLSH
    T1AC642343A2DB8230C25D85BB94D2C4412BB79E4976B6D38C7D447F92CB6362E6CB3235
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsheetratunix_stealerpersistenceransomwarespywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects UnixStealer payload

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: UnixStealer

    UnixStealer is a Windows stealer written in C#.

    stealerunix_stealer

  • Modifies WinLogon for persistence

    persistence

  • Clears Windows event logs

    defense_evasionransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2