Extracted

Extracted

Extracted

Extracted

• • Target
    BUILD MAKSIMA WEBRAT.exe
  • Size 7.1MB
  • SHA256 7d6bda909b93101c5b476d98dce3214157d0fa6d3a65c73b2790f2784d2ed9e5
  • MD5 247eacb124e61c31bb64d66a9b3a1fe4
  • SHA1 29b421c05a9c67f88d7f2599b61003a982d8bd03
  • SHA512 8a95a66aaae0fd414df95bffe86da959a2041292ef418f7d176dcca461288b98d886ce3cc52c03ca2cd4299fe3af1642cea251866089a999033860760b359b27
  • SSDEEP 98304:Iqffrqvy0IE3tG1W5qlNtaaRQumvBh8huTIE:ISUy0FGiqlNthy
  • TLSH
    T191763907ECA514E8C0BDD13189639653BB617C485B3223D72B60F6287F7ABE0ADB9354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackedsheet_wvnkneyyxndefense_evasiondiscoveryexecutionnjratsheetratpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1