Extracted

• • Target
    2fb6vyicwc32f7ev.exe
  • Size 184KB
  • SHA256 5724cbab205d2dbbf0a257675d91715f55e7851de1f65ea6f038a0e42b28f4d0
  • MD5 288d11aea9ea90f370099dc3fe717a2c
  • SHA1 f006f02caeba0f9c96dd2a6c8f1dc7d6d4c3b37c
  • SHA512 51c2030a83cf0bd5e27695b0782aed71fb5227319524a318104495917a5bf9cf98685c53fa47df2bd5530e391fcc82e2ec6fb6f9eaef89c1e926f96bab0defd5
  • SSDEEP 3072:wIBHkRsVdnHWK1kTsabVcBntOXVd5hm29XsuoS2ah0M6jOmnKBUttttttttttjke:CoWKgZVVE26uoS2a6M6imnhttttttttT
  • TLSH
    T15104F2987BCD8961EAAF577DC38362200F34C21B4913E74B1DCAE0A75B263D9AD01CD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  123collectiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojanadwareransomware

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2