Extracted

• • Target
    Client.exe
  • Size 386KB
  • SHA256 bf8fabf15a52d42ebb2d9ca3a3829a2da97a002ddb0ea5a86c74e35715ed89e6
  • MD5 b897f4320a800601fed7e5a5841e3b2d
  • SHA1 50d1260b8cdaab72aa2c7d3a847e05de52ee495c
  • SHA512 3d99f508bf83a39fe49f95eff289ec0cab57dc618a9911b104e5db5c2021eb0e75c44db161ccb036a26d450a41e50ab1e36667b681ad00ae372e8e4eae41c02e
  • SSDEEP 6144:mWwxsvLVVHxZn8y93r209k5Id51abSsthyApBRp42khbsGiy4xNM:mWdzvEo3IUaBRp42Giy4c
  • TLSH
    T1E484D50CBE51F905CE7A3DB3CBE6A061577212C23E229216274A6FF8476537A4DA317C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  • Drops file in System32 directory

  behavioral1