Extracted

Extracted

• • Target
    bb8875d23c2e954f3adbdb23561dbda37f7ea2e3b533b3ae5f84a28230e6880e.bin
  • Size 20.3MB
  • SHA256 bb8875d23c2e954f3adbdb23561dbda37f7ea2e3b533b3ae5f84a28230e6880e
  • MD5 e1880c635f3d32a5761c6c44d208a425
  • SHA1 d4881ffaa1f6f654a7a5c934f58f60ff5852f58e
  • SHA512 b6cc1c0f86fa0f308dd07f010dfd33ee97273be4159c9bbef3265304e887dcce4bfd9f250c4dc8898dc1a36c6f864d0624c1adadf027091c00e3a74afeba83e1
  • SSDEEP 393216:kybveTt99hQLIenbyUEGmrLzUJEexxwosg7i94tXFi4R7:FevD+yh5byqC64tXFi4F
  • TLSH
    T160273357E2E28FDDF03641B02954BE168B240B28C75141C1A3DBA763EF85AD7DE02D9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2