Extracted

Extracted

• • Target
    XBinderOutput.exe
  • Size 618KB
  • SHA256 fb39a9b18bb0f1bfc6aa8c24d702566dda0b758de5842f979a5e0c68ba92f213
  • MD5 8a1b2f1fef04a81bcb4db540b640388a
  • SHA1 0ad9f6e2d7a86536625fed61ba01faa46419c273
  • SHA512 cfc939d046f804dc2a1da029f5e839211bbc0e0910c805e1bf992973017f5cc9b406c3c82a2c564e8bb88173f865a003eb48f0754f96fd0b8269369b83fe1f06
  • SSDEEP 12288:WM+sGaeIGyRvBGM2JrvNzIkdoycQV7+4q3X3U59cuMFFPsuU+v:HQIv9B+rvNzBdoy5V7dY3IzMH2+
  • TLSH
    T1DBD4234C54820AE5CD257D7A843B937741FCDE1BE99B65A7896A8392CCEBDE82330704
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondracula_stealersheetratxbinderloaderpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1