Extracted

• • Target
    Extreme Injector v3.exe
  • Size 1.4MB
  • SHA256 68832065c1e9dca5f016465885d28338bcbe921fc2c33c38cbe2759e79b5dd11
  • MD5 3ce3d832c45c0961a14e1d68b3af740f
  • SHA1 f6f22ba53d94c40789d78b4c5c6420a77612209d
  • SHA512 f3db8035cfa6b87e74664f49425cc3fd08e617ead0c6988be5fc74ac915144786456e33130da9ae9db3fb81b33707352f8f66837411ab2b0b792dc9783afffda
  • SSDEEP 24576:OAOmi5Vm+lBnehvY2iPr93CeF1LH1Xt5QezP9tHtR9JSWmsMrlA18VnZAWQv:34FdetMVCK1LVXXQezP3+Wgm18VeWo
  • TLSH
    T16865333473AEC852C20F09F32B1162F71F35F6BDE9761B768B1533264E26975192C0AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_taxrymetaaydefense_evasionexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2