Extracted

• • Target
    Client.exe
  • Size 571KB
  • SHA256 05024af1710d3deda9991afff6318decd666f2e6eac4ffce7356e7c3766ef68f
  • MD5 7957520ef1e47b488a27e78447f9444e
  • SHA1 1df2717c9a97dee0f8a3c18aac20236afd6b8741
  • SHA512 650cd8040b3eb380df065e3bf2258c5c8f9055838ee2c1ca35b2cdfb5aefa8d21e77c481b71f9f1892ef1fa7c692fbf116fbd857b6025eb3f6ea5ee6e40aa6c7
  • SSDEEP 12288:+L3NTxO6XiKNYRRgj38+An91vZL8lakjg:+zNTEoNz38lrq
  • TLSH
    T167C4B30CBD91FC15CE793DB3CBE294A21B7211C23F129616274A6FF89B543B649A217C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  • Drops file in System32 directory

  behavioral1behavioral2