Extracted

• • Target
    Nuls cheat.exe
  • Size 438KB
  • SHA256 40ff553f5ae11c6c21453eb2602c90390f7f8debcfbd50b41a4a497725c32188
  • MD5 6bf6bef95c5f5d69d606c7659638624a
  • SHA1 50d055138ff4defc2bf0746c8f679488621c45b0
  • SHA512 8f9204c9e10dbbc82863b140b6cd05f96165811592911f7e5f7341d064066cfe7405c7ad1ce3cb8889c9f1a5d659b72b6559a32d253b668cac1e7fe665f45c59
  • SSDEEP 6144:wxOUbQTvTRtWfcWM3A+e6VlWT8b9QUdzjmCiJie0jbWYgzZ3c86yy:wAJRUfLM3FPVle8S8UJvsgO1y
  • TLSH
    T1C1A4C50CFE91F805CE9E3D77CBE610104B7125C22E2596963249AFFC9B6537658E227C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_eelnzdrfwbcredential_accessdefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojanupx

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1