Extracted

• • Target
    Velocity/Velocity.exe
  • Size 4.0MB
  • SHA256 3d77113574d8cd3f13222ea44173f933b7bb00ab22d6899aa4c954eef98fd325
  • MD5 d28f7a60805177423ab738e386cd1026
  • SHA1 4c1244fcb11b5714b7e9f31139d96dba02765f13
  • SHA512 9ba5af1ffe378bbaf11f2574396da4ac41d8767530d5dfae8cea50f179d48d5e5fa45ae9fe1c30b7cd765cd7e0094e8c5a4a5910cf4809249f01920ba51a2cd3
  • SSDEEP 98304:0JN7MTyswfgykopPt3Lp6Ay4YNZ7PBf0T1aZ:oaxwfBkOP5LkAyj3Ng1aZ
  • TLSH
    T10C16010CFD91F806CD1A3DB3CEEA14145B7161C2AE2292533149AFFD976A37249A763C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_nbszmiyxtaxdiscoveryexecutionsalatstealersheetratxwormpersistenceprivilege_escalationratstealertrojanupx

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect SalatStealer payload

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1