Extracted

Extracted

• • Target
    231fd53698c2b599aebbc7bc2ac24d813f06a20684283a4d9cfcebdc4004ad94
  • Size 305KB
  • SHA256 231fd53698c2b599aebbc7bc2ac24d813f06a20684283a4d9cfcebdc4004ad94
  • MD5 3e4d46612eb70a89364566b286b2b000
  • SHA1 4ae4911d2074412c646812ea485c8918d874f285
  • SHA512 1490291b09138ff1f48f868b693165fa7da7b0c88bb90e4979eba6919b3cd9e43143e39f73aa1ff75589fde9c56de58bc1039f76f71d8f7bdeb22892a8ab5a9d
  • SSDEEP 6144:2EJ/pG/8PPD6X8f/KEAktawK8rImgitKq869LKHmH3flFcYxuNHsTaPb9g:2EJ/M/8Pusi1kkwK8KqBOGv46wH
  • TLSH
    T13D642322B2DC9123C2EC46FE1460D1490327FE576ABAE708FAD8B4F9C241A4556CE93D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratunix_stealerpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects UnixStealer payload

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: UnixStealer

    UnixStealer is a Windows stealer written in C#.

    stealerunix_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2