Extracted

Extracted

• • Target
    q5al7gptqorykz1g.exe
  • Size 489KB
  • SHA256 69f215333a4cffa7e9029a038ea272e5777021a33a25b4bf4fce376c44373d0c
  • MD5 abc12f59e6cc65083fc3d7ee60e0a791
  • SHA1 cd4524ac4dc547a0e30b8bb19165dac63cddb1ec
  • SHA512 2b49168b64caf62a40d11b3e601f16a2bdf72a335bebc8433fa45255a83770794682e8a9ad950467038b7e8569a3fb669184c20782bbab8c867309709376ce41
  • SSDEEP 12288:UPSznx0ZaCb2OIUFKNMXnhyhcm/5Urm1Cjkc:KaCbTKYgh1Bu7
  • TLSH
    T18CB418157FA58E00D480157ECA7E3A09CB16E0F225026347370AF7A25D469EEEE6D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojanaspackv2backdoorbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2