Extracted

• • Target
    1234.exe
  • Size 195KB
  • SHA256 38005607bad6dd05b1cf807b2a0d26713808aa28b98dcec7ba1cb0df335e02f8
  • MD5 cddab57fb3a758d783d9c0339f7a8e58
  • SHA1 0af30ffde04a4fe7693153e51c7e9042fd566429
  • SHA512 2c1f3f22af07c2a82c0dd39b7b8c6ac041c50ab1e69a31400c9b6ee50088f4d290b32f062d96510318cc0202153ee8a4ad05d6409ae9f10c6a0c5b2f85222ca3
  • SSDEEP 3072:q7APv0k/0ieshm0LfxB7f2mfTI78Lt9G8sMGBXzLwYBdg5bZPhiSaAukObnNZtOA:+bsBfMvDhcYBdOblMrbJ
  • TLSH
    T11F14F10873885951ED3F4AF9C3D323459B32F2631182D70F2DCBD0D62E96BD9AA49C99
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecollectioncosturadiscoveryexecutiondracula_stealersheetratpackerpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2