Extracted

• • Target
    pigggggg.exe
  • Size 7.1MB
  • SHA256 10285fb3a4b3cc8cabf236128a5ea21b39abc22fcda17748cb5fcfbbf23d11f4
  • MD5 9f16b4beee11682b82772082c2503eb5
  • SHA1 da6f6dbe4542d24289b801db659b6cf3855cdf01
  • SHA512 5466c802b5eeb90f2f5dce2da3ab53fe2246c7602beb0cf3d22b07bee58e01c6722cc6669cde2b3a37bf36012bc9c46c3b0a3152057a26359597cc5e5b82a70b
  • SSDEEP 49152:8udzch1fTHm5XoYjOssvdJxJY/L8jiTa4Ml+KOyxT5CthOpnkTDVNMm7umIKVK1k:8uGJLw6IKzmNMumvBh8huTWEO
  • TLSH
    T167764A17ECA914E8C0AED131897695537B617C490B3163D32B60F6283F77BE4AEBA344
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsalatstealerpersistencestealersheet_kzmcescgwtjsuthvrcredential_accessdefense_evasiondiscoverysheetratspywaretrojan

  • Detect SalatStealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2