Extracted

• • Target
    cwp47cnctcad2l0t.exe
  • Size 61KB
  • SHA256 8b75a5f87e2421ff44b5e10386729dd4aa09d22e0501fe9e9a140a45c94ee41d
  • MD5 5a6a9d52741d9369f84c883d9a035ac0
  • SHA1 ea152dbf0f35925584315c4205836072011fa9e3
  • SHA512 c44f320e123a6646ee1bf1e76182c824b20ae66bbaf7479e327161be1d4969b1fc95d4c45f548fe3cfb637e5ddd4739f6907ee8b71c4109cecaa3b2a70063421
  • SSDEEP 1536:Gk3zKZfx0B8tKlvVvzAzywhSObnNd/Lpx7QIrNAOM3hMT:GkIfx0+tCvZlESObnNd/Lpx7lyQT
  • TLSH
    T133535D053790AA11D9BF55BAC2D373A09734C3436942D70F1ECB90CA2F567D98E1ACEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4