Extracted

• • Target
    I6od2a5Fp8xYTzTH.exe
  • Size 714KB
  • SHA256 fa01cb60d81d40220dfd89c38d469a54cdac89e4dd9b6f978e4f7cc573c19c62
  • MD5 261f57f1d1b76dfda57202a05450a44f
  • SHA1 4afcc3057c53ea0f07e4d4a8a71d9e28678364d0
  • SHA512 03461bc0b8095a4db11480608be8bd6fbca3ebe6416c6d01d6abae293e85c0d7746b99cd0fd9e443f41afce5cd88175dff12af59d95c6478e83c38cd80329304
  • SSDEEP 12288:3CclEQhyEREpyFvM3iriwqf5dojE84ik:kQQmyy5MXwAIjvk
  • TLSH
    T159F490252FA4AD00E549143D897AE634D731ACE11602B34337CABE63BD0A9DDDE6C3D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryexecutiondracula_stealersheetratpackerpersistenceprivilege_escalationspywarestealertrojan

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2