Extracted

Extracted

• • Target
    zov.exe
  • Size 19.5MB
  • SHA256 32b2a9e4af7847682b0ec5c168ef8e9af3b0e9b25788211e105ca00b80c785ff
  • MD5 957c29304c8c7210f82d06efc7ac6753
  • SHA1 ace0d1973aa2adeef0fd88fab151c25842092e63
  • SHA512 a9f2ca342990888fb2b62069f2b30eccce4ad4d7a7ee0fe51d751fd4d50c5590ccb00bbf5eb98440dba7dca3fcf75b4e1db086e4cf386e80b7f4e59e6453747f
  • SSDEEP 393216:Ypexm9IRnV4qHA+4qXJ8/Gic4oyj6KIVKzQv/:j89Sza0SVNYVKY
  • TLSH
    T10227BFF1184287A9AF6C76B080E785BDBBF2574A3BE2C8E1D70DDD0578518442FAB85C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsheetratumbralpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Detects Umbral payload

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2