Extracted

• • Target
    neverlose-server2.exe
  • Size 196KB
  • SHA256 8a78744d911c0634aa2988469c7aa18e163bddf9403f19f3fdd6fa8762b7e7d2
  • MD5 be8c6f589f9e0bf1dc36efabeabd0554
  • SHA1 9ac3962af4711232b83334c102a14b394e10d0a1
  • SHA512 351d84a7494cc15c93a7a8509970800816b612b795de634c2f4c043d1fbd01459f617548165fbc95fc21e86a4d802a835c220b0b22d8d92060bd3e6d34839fc8
  • SSDEEP 6144:IU1ALyBDGWuL3gNbj0d7n891fNASAMYrZI+JqKxbt3gl:3/GWkgNHlfN0MiUKHY
  • TLSH
    T18914E19877C18552F97E0AB6D26773409730E3870842CB8B1DDB90DA2D73BD29646CDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nlcrackcollectioncosturadefense_evasiondiscoveryexecutiondracula_stealersheetratpackerpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2