Overview

overview

10

Static

static

10

lib/Liberi...ro.exe

windows10-2004-x64

10

lib/Liberi...ro.exe

windows11-ltsc_2024-x64

10

lib/Panel/...to.dll

windows10-2004-x64

1

lib/Panel/...to.dll

windows11-ltsc_2024-x64

1

lib/Panel/Client.exe

windows10-2004-x64

10

lib/Panel/Client.exe

windows11-ltsc_2024-x64

10

lib/Panel/dnlib.dll

windows10-2004-x64

1

lib/Panel/dnlib.dll

windows11-ltsc_2024-x64

1

lib/Plugin...on.dll

windows10-2004-x64

1

lib/Plugin...on.dll

windows11-ltsc_2024-x64

1

lib/Plugin...ss.dll

windows10-2004-x64

1

lib/Plugin...ss.dll

windows11-ltsc_2024-x64

1

lib/Plugin...un.dll

windows10-2004-x64

1

lib/Plugin...un.dll

windows11-ltsc_2024-x64

1

lib/Plugin...er.dll

windows10-2004-x64

1

lib/Plugin...er.dll

windows11-ltsc_2024-x64

1

lib/Plugin...er.dll

windows10-2004-x64

1

lib/Plugin...er.dll

windows11-ltsc_2024-x64

1

lib/Plugin...ra.dll

windows10-2004-x64

1

lib/Plugin...ra.dll

windows11-ltsc_2024-x64

1

lib/Plugins/Chat.dll

windows10-2004-x64

1

lib/Plugins/Chat.dll

windows11-ltsc_2024-x64

1

lib/Plugin...rd.dll

windows10-2004-x64

1

lib/Plugin...rd.dll

windows11-ltsc_2024-x64

1

lib/Plugin...er.dll

windows10-2004-x64

1

lib/Plugin...er.dll

windows11-ltsc_2024-x64

1

lib/Plugins/DDos.dll

windows10-2004-x64

1

lib/Plugins/DDos.dll

windows11-ltsc_2024-x64

1

lib/Plugin...op.dll

windows10-2004-x64

1

lib/Plugin...op.dll

windows11-ltsc_2024-x64

1

lib/Plugin...er.dll

windows10-2004-x64

1

lib/Plugin...er.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    LibExploit (2).rar
  • Size 4.6MB
  • Sample260806-ea158aserd
  • SHA256 4416a0161c8d129847289d72fe5f1f2cb388ff981635bc3e88b600d663350e1a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
dracula_stealersheetratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Targets

    • Target
      lib/LiberiumUltimateExploitPro.exe
    • Size 532KB
    • SHA256 e3971654d4cbc4cc46e14bbef88ea0bcb5de90cc1b61920a64788b7626cb5089
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

    • Modifies WinLogon for persistence

      persistence

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1behavioral2
    • Target
      lib/Panel/BouncyCastle.Crypto.dll
    • Size 3.1MB
    • SHA256 b474be40249aab5de303b3052c52a1349a06e27e8e54f956085465ce140d2bac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      lib/Panel/Client.exe
    • Size 43KB
    • SHA256 793480a061cb2af067bf9697649b8e5d0c9d1d58def4e0979feb39490fb47826
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    sheetrattrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat
    behavioral5behavioral6
    • Target
      lib/Panel/dnlib.dll
    • Size 1.1MB
    • SHA256 f2c1f407811acfd1e926e61d6b71195b2f1c5aa54e59c2a43e6bb63c4e01a1d1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      lib/Plugins/Action.dll
    • Size 27KB
    • SHA256 e02c7d4772460b5ed8c9deb4d9c42f9307ab2e91dcad88d370c56852e2cb3cd9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      lib/Plugins/AntiProcess.dll
    • Size 10KB
    • SHA256 aa5613397f63e46ba3c6d8f23f15cfc3968715c15eb3c8bb3f7e1e6ebfe05a95
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      lib/Plugins/AutoRun.dll
    • Size 331KB
    • SHA256 07b7c2db79493a5ee49b608360ad480376efb5a2decc53e17938615d0e246143
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      lib/Plugins/BotKiller.dll
    • Size 25KB
    • SHA256 93b2051501eafa809166efd20947d3b25dfa09dd8d7e32baf41345cfdde421a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      lib/Plugins/BotSpeaker.dll
    • Size 14KB
    • SHA256 5dd8a71a59d707ce9c6391bad79a89fb25ae00c46f366aa4732aada6190b49ad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      lib/Plugins/Camera.dll
    • Size 94KB
    • SHA256 e686aa88a2f25a1b966fbcec46be82bf0ed96c54715426ac090b1b71c8972ee6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      lib/Plugins/Chat.dll
    • Size 43KB
    • SHA256 4bab443475ee2926ef442a2283c55d81dac20d4c7dc4631f54bad03cd1a2f302
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      lib/Plugins/Clipboard.dll
    • Size 13KB
    • SHA256 94f58501a3d911b7da346861e3f3215ef42ea5af5ff9df6283a278f9322b4d62
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      lib/Plugins/Clipper.dll
    • Size 15KB
    • SHA256 a7ed33f5a2ca75094f83d98a2fb9193442cde93aeec09544eee2771ee5340b23
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      lib/Plugins/DDos.dll
    • Size 106KB
    • SHA256 22e6b4d12488c38461a4eaa8024c903394f6b2ba0fd079cbaf8e6e715117bfe5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      lib/Plugins/Desktop.dll
    • Size 696KB
    • SHA256 d2c817db4843f8f230dfb9fa3b66ef4aebc75856f1cec3cfb3c3397b8b83092a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      lib/Plugins/DeviceManager.dll
    • Size 14KB
    • SHA256 badae34033402c006e2d03e6c70be61acbdded08fcc8807d54a9f9b93e23498b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

trojansheetratstealerdracula_stealer
Score
10/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
10/10

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

sheetrattrojan
Score
10/10

behavioral6

sheetrattrojan
Score
10/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10