Extracted

Extracted

• • Target
    XBinderOutput.exe
  • Size 827KB
  • SHA256 b1f4158f00e0bce795a110d6f4840e14b1a7b99b1b6b6f41175f5ed639f87f8a
  • MD5 9861df936c892dea40dc0fb34e8f6782
  • SHA1 b8e9038d38bda22e4bde694ac4e5285a75b2dc49
  • SHA512 eac5f0be8467ee98c63c1e5de0b4b655a90dbece77713b45ce3ce6f2ea0b9a7b585de37250bb34edddda0801f00bb4255f16755b79cef42ae77c5f3148701a64
  • SSDEEP 24576:dfRRhfgjk9EjY6FD6EHX2pnZZUxlSKOtNIduW:dJDfgjsCYm6EYnkjO7Qu
  • TLSH
    T10B0533C154EA2B68E5662C34DE9344C3297851FCDAF74E023F6C87AC9D0E78E44F2A64
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradiscoveryexecutionsheetratxbinderloaderpackerpersistenceprivilege_escalationspywarestealertrojanupx

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2