Extracted

• • Target
    DiscordSetup.exe
  • Size 139.2MB
  • SHA256 848a366bae8d3a87dc1f175152dce1812d949376e9ec1659c3c10d09c7024bf5
  • MD5 854f8f1eec99683f578d640854ff5fd8
  • SHA1 6d375069dc0f9d60af405e382ce1207cb251ecc9
  • SHA512 c8e25a077748a6d20900b94d5a961263cecc93631b8873830d4b74d047878084fd47b1384af4e7515015ee7f241d738042f2c4e1e036e403e93e8030706aef1d
  • SSDEEP 3145728:V+6t0EWSSXDw1mLjnVwQ+JBzILsHeNEEJYQUG3FlGYm:8/EWS1oWHILs+GdZG3LG
  • TLSH
    T1AA6833E65D2C00CDAEA24D7FA7054FCE53AA4C683995C5650617331C08FBAA99BECC4F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_rszwfsnhbajcredential_accessdiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1