Extracted

• • Target
    solara.exe
  • Size 310KB
  • SHA256 763de5c1e5335f0fc85be4967db62113f8c35956b45e376e1263128791b523eb
  • MD5 df3ac46b9ea57a4655ba433037ff240a
  • SHA1 59776a3c089880c6843a74eb9345fbab1a3042e7
  • SHA512 893b7f502edf0d94d15c611eb5ae4c851c7344213bd519522034513a9a7c68696c12f3cb97b0191eaadcf5926a1a971de2ac05fc10b3b64b3882a8b7ebca380e
  • SSDEEP 6144:VAm1AA4j2Srq3r209Zg9QuTbNcDCBrTl9TxHmSUscLk:ua4CSrq36/6uBrrTZ5
  • TLSH
    T11564F80CBE51F904CEAE3D73CBE650605B7221C23F229256375A6EF847553B689A31BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2