Extracted

• • Target
    Checker-BloodyDM.exe
  • Size 466KB
  • SHA256 7e4c0c545b82a1c9e400f2599ac18b17e0161c8bb07dd607af751e811496728e
  • MD5 82158b434fdb53bb3d2112ac8d589787
  • SHA1 080172603f20cc97cc9bd8788f8c8e1a128d546c
  • SHA512 76bc4f17d59d27e72090c3751e4618e7f44cd4e2838b7321a601f0e4ac80b9be6dbdcd03e43d25143b730497bf0c53b0051f85768cbacc04d80749e3f1e82770
  • SSDEEP 12288:GPSs2VNoQtw/a+ydSw2qQWo2Pc/TXWRu:nVeQtwCb8rqL+TXW
  • TLSH
    T1DEA408253FA98E00D451257ECA7E3A09CB62E1F125027347370AF6A65D059DEEE2C3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2