sheetrat | bc33879a61c2d75794fc4dc6f37fb433bad6a9ae7a989d72037f2e67b9989053

Sharing

Copy URL Twitter E-mail

General

Target
bc33879a61c2d75794fc4dc6f37fb433bad6a9ae7a989d72037f2e67b9989053.zip
Size 1.7MB
Sample260708-tskzaact2p
SHA256 bc33879a61c2d75794fc4dc6f37fb433bad6a9ae7a989d72037f2e67b9989053
MD5 a9ab0b4314e90669192f339c3eff535d
SHA1 d90175b8e21e26398bf105a2184632bd5c86088c
SHA512 96176b41912ce3b85954e55b2280b258ccbd0700faab2cbe84e8e19c20610ca182d0fd55fb4f87e9c74bfab60d7c1e4137985add927850615bdfa5cc4390142d
SSDEEP 49152:ucL+uUAtWfxtqOQ154PB7RrQFLFOF8XTI0d:ucNttWfxtqZ4PB7BQFLFI8XTz
TLSH
T1DB853347B81AE52EC2062577084EB86F4407B34D1D6F5BA9E71262DCFAF6DA03A75380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

sheetrat

Version

Zetrx555-59155.portmap.host:59155

Targets

- Target
  проверка/Everything.lnk
- Size 1KB
- SHA256 d39b880e8bc7514427de87587c8849e03a99c35b3e5230ab2acf1f26d01fa9cd
- MD5 3863b3db1cbe6f393cab70a5cd390c89
- SHA1 ad08153c77ba21e914af765987fc8f3faf127cd2
- SHA512 ed66048cebaaf69a714a43ec2cae9b25420ad11513715934bcb4f68b001618ef0a5e11b39549bb9a85b484f880ea5b02c3df2fabfacab20b255b5d564e272c89
- TLSH
  T1BA2100014FD6573AF2E38272A83296225762F800DE9C5F2F1446834C1D73126999CFFE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  проверка/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  проверка/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  проверка/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  проверка/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  проверка/general (ALT).bat
- Size 3KB
- SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
- MD5 cadb63e600829d6d26aaac973d55d89d
- SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
- SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
- TLSH
  T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral11
- Target
  проверка/general (ALT10).bat
- Size 3KB
- SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
- MD5 9a77b713dc626138ec7421f560716a28
- SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
- SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
- TLSH
  T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral12 behavioral13
- Target
  проверка/general (ALT11).bat
- Size 4KB
- SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
- MD5 81d21053303452399da6b09313cac0b3
- SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
- SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
- SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
- TLSH
  T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation adware ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  проверка/general (ALT12).bat
- Size 3KB
- SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
- MD5 707e7f6492429b89d52a665cb47d2e1f
- SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
- SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
- TLSH
  T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation adware ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  проверка/general (ALT2).bat
- Size 3KB
- SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
- MD5 802a10c9f71f69ebe61eeae7693ba0e5
- SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
- SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
- TLSH
  T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation adware ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  проверка/general (ALT3).bat
- Size 3KB
- SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
- MD5 aa4abe5d986341f92ed5529c58002d5c
- SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
- SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
- TLSH
  T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral20 behavioral21
- Target
  проверка/general (ALT4).bat
- Size 3KB
- SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
- MD5 1a9353401fc545311572880d32a88f78
- SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
- SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
- TLSH
  T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation adware ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  проверка/general (ALT5).bat
- Size 2KB
- SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
- MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
- SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
- SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
- TLSH
  T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  проверка/general (ALT6).bat
- Size 3KB
- SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
- MD5 e6973238d03286140e2469f9616c9edc
- SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
- SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
- TLSH
  T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation adware ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  проверка/general (ALT7).bat
- Size 3KB
- SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
- MD5 a8efa3ed6068b339fd86951c80e84c2f
- SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
- SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
- TLSH
  T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral28 behavioral29
- Target
  проверка/general (ALT8).bat
- Size 3KB
- SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
- MD5 a2865133b7b6bc0adcc51acb7d64ae20
- SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
- SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
- TLSH
  T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral30 behavioral31
- Target
  проверка/general (ALT9).bat
- Size 3KB
- SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
- MD5 4d6ced8c4790b06aba64d176a2ba5e9a
- SHA1 4ea98386b069cc339e301da4ce8c777a81fb0111
- SHA512 71a6234afd9e08d6999d90b765bba7781063a8e76fee8e8793be0a17b31e4bcea4342da6e4eefd4e7e42ce1edf39d9c1c58120af79e56b45d8337ec8b082c099
- TLSH
  T170616A93E00DDF46B48D6C7EF89BA5B52017C8872CD6D852539789F8C44EDAE5C4F085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26