Extracted

• • Target
    sheet rat v2.6.rar
  • Size 35.3MB
  • SHA256 6cc2f739e10671b4fc02341b6ce783bd4e832b40af4f458dd6dde2bdc6046b7a
  • MD5 252f8a51e766f6eb1061534b3ee19431
  • SHA1 a72f5d5208e361b76f543c5ffafb9773ebed2db7
  • SHA512 d3fa530dd6321b8fd91b0d94a1dd7ca367deaac1dda614caa5c0995dfb1b98d3c7d8089e2321d540797cbba525136a9cb7834b7f3da220a816002486857ec6a4
  • SSDEEP 786432:cHjjC3yxnyFIDjaLuYWDi3ah1h3K7Tgt6xF3wisOYyfKgWZ:cHioyqD2L6DTScUxF3mOOl
  • TLSH
    T13C8733C36E29CD323D703A6422A0F6D085D4C9EFB144696FF635BB8DE2D112ED18694E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondracula_stealerxbinderloaderpersistenceprivilege_escalationspywarestealer

  • Detects Dracula aka Samurai Stealer payload

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1