Extracted

• • Target
    727dpw9zbeg97b1g.exe
  • Size 495KB
  • SHA256 2d5bf3c2c147f516d442ff9f25f20b09c7a61719b28bd13fee1d84cf2d8d69e7
  • MD5 02988386464bb1682340d21259a39cdb
  • SHA1 f95806f2dccf0c02922656117ff4afb0b48e1122
  • SHA512 f40c1e2b6d0a433aac2b8d2c4bf212bfd311d575c507a628a6788716193f4e512bbdedc218c68da7c47a4504e0fc6f6e715b729e3dd0935ab77a1bd1ddbf442d
  • SSDEEP 12288:7tAb/o9B6A1YeHsGfXBQiWT03+uNhw1gxDA7rlRyVp:djMeXBTWo+chwOxDKZR
  • TLSH
    T15CB43A257FA88E00D581253ECA7E3A09CB12E0F225026747374AF7A25D459DEDE2D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2