Extracted

Extracted

• • Target
    Everything.exe
  • Size 2.6MB
  • SHA256 1568c7c5a406c63d713a2822cad82b5284db8fd360463d450f1df78e31583d0b
  • MD5 1cdf6dbdae7e55455803d4f2d99db88f
  • SHA1 5e092e22c73fcd040b0ccb23ac37f32b74eb7fe8
  • SHA512 dbc3bb6d534e6a7ca016640a404484ca2365b29c680171f32b57bdbd9fb32e07a52a9d2d574a5bf54ce71e0d47f4cb61658453be8c438f1698d0ab1e8da3dda2
  • SSDEEP 49152:eOtTYNl5fj1P/cJPDrZPM/Ns4BbnQAwsDNOUZHxOezRk1+gLTbhoLOE+uy+:eOtTYlj18JqYEnEMRk1+g/bamuy+
  • TLSH
    T18DC52322B9908431DC5208741AE2B272E37CB9B85FE45FD7A7542F695F700E1DA38AD3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  gtavcredential_accessdiscoveryexecutionphemedronesheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Drops file in System32 directory

  behavioral1behavioral2