Extracted

Extracted

• • Target
    Hustle Launcher.exe
  • Size 141KB
  • SHA256 ab8c9338a2f3efd90ba3d1f7b3ba7210c200b80565f180be11bcccb9904677d4
  • MD5 c52a354a800c3b36136dc6a298aed131
  • SHA1 c5a147ac801c19be1a92d80b4f14fa92149d91c6
  • SHA512 9964c537c7df4ef89155e44e94265574eb1949ada79b876fbe9cd7e5c1ae292a97724572861c3424f4b322314d93f5f558678096dceb0713e164fbb7c1679bc4
  • SSDEEP 3072:w5K7H5sKTdmUx3s2vbfM3UYnK6OC3MloryO4c1SFyh:w5EH5jJ31oOC3MOryO46S
  • TLSH
    T1D0E312D60BD70B70DA7F8BB46FA722D093B7DB16BB433BAF480449110E461D84956B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondracula_stealersheetratxorium_stealerpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects XoriumStealer payload

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1
• • Target
    launcher_ui.html
  • Size 222B
  • SHA256 56043868ffd2c34ffc166c871df34876895130149cc304187ccd86a932683852
  • MD5 32c9208ac96fc24114fd566ba52ac04a
  • SHA1 bf26564f2af17dbcf91726d59d1028ff64bae4ea
  • SHA512 60d97f23f364d7491c71b2954c4fa2912322cbb925fe8505db0f05dd48d3b9747aee95df9bf94e0e52f3190a0555995eb6e84248da678356426e425fd0fd4dec
  • TLSH
    T1B8D0A7DD503C290BA990F3806D9761A224850284A8CBAF146DA360BAF4CC22DFF14096
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  discovery
  behavioral2