Extracted

• • Target
    Installer-1.0.7.exe
  • Size 620KB
  • SHA256 d20e95fad0312eda307c6cb2f694cb91b362d3ca9e46d11d54b9625815ea7d50
  • MD5 f038236aa3528ee3ce868cd984e1e8c4
  • SHA1 9da367af92fc95e2c39014cac47718738a7c1d0c
  • SHA512 94d4f0a8ddca36fa0c373c4cc1ca143a664a27be43772cda8001f76725eb4374035c5e5cec8ca39fcb337c03ed6a6efba802e185ae9f5dc69cdcbd1df835b1fa
  • SSDEEP 6144:SZkzi245Pq7iLvm/rfbye6VlWT8b93X6owGY053Ip5mxyytibpeGHZfIXwGvHPsJ:bzAHPVle8Y2ur1ytgNfOL/Pi
  • TLSH
    T175D4E50CFE81E805DD2A3C77CFF951044B7166C1AE229A423219AFFD8B6637259E257C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankersheet_ogavnbdlqirfxbnidiscoveryexecutionramnitsheetratpersistenceprivilege_escalationspywarestealertrojanupxworm

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1