Extracted

• • Target
    Fatalyti louder.exe
  • Size 323KB
  • SHA256 32cec9d929dab4bdad3d1f53d23855e32a240c34efeacf350948f5c231918269
  • MD5 da3c1730beb633e3f5b2abac881632c5
  • SHA1 121a87087d6670b3c5d9bd4774f224c7b80da2f1
  • SHA512 1c418de29345d7f012dcd0efaa095d2339834768ebd848c1f777f8570aa4d2fd144be58869f6227cb0d97ed18cdf8d21f98f9090541898a8e55479657632f16f
  • SSDEEP 6144:r5Ml70vA54e6VlWT8b9ze1bpRDB4RX5vob0vUlCs6GK7X:r5gwvAyPVle8Ve9V8vSCs6G6X
  • TLSH
    T1E964D50CFE81E806DE1E3D77CFE620104B7121C26E219256364AAFFD8B553B658E65BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_xabziyqnhowycehicredential_accessdiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1