Extracted

Extracted

• • Target
    ElysiumExeFree.exe
  • Size 598KB
  • SHA256 5dd43095d776ec91ac49a1974da75000d61167ae79181a38ba9252c3caa424a7
  • MD5 0bcec7ffedc63ca3e6a9658ab41e2240
  • SHA1 cf90986f4a9e235825259c8a1ddcaaed5674070e
  • SHA512 8f863dc5a2883f026342c59c3abf632bfe5c68ef8da55e678fcabdccf8974c50dc7d52e7f4cabe70649b4c39cf3016eb2f6e7ca23f3cdafe48b7c838c4a79ef4
  • SSDEEP 12288:s4v7r++Hla8cG8SstrhFoo+FU4XLutmTn+AS7EtVlq53q1Kzx:HflHsG8tX+wtmD+AYEWqsd
  • TLSH
    T149D4232A9E01E937DF9A67723C993488F02AB3431DE5BA0B9AF3D1D11513F6217A59C0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_mvllprzzibexecutionsheetratxbinderloaderpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2