Extracted

• • Target
    DeltaCrack2026.exe
  • Size 30.0MB
  • SHA256 3fe00a92edf86b1567c9f27c3e2d9d8020957a3d073b4a149915c5a50e471ceb
  • MD5 64206803866e7384737df156c5629a34
  • SHA1 d8367161916fa59e08d89ec88397cd0539d8173e
  • SHA512 b23a8d5ac4a4814757a0f5e6b649d07e7572e485db43c39acb333102075161aa65c8c699e7061383f3bc196f3ac3d8fabb42bfdae05fba05017ed0f340db8466
  • SSDEEP 393216:VRBo7T6DhTqDXe2UVzhrLPS4A9n6RkpsnfiUnsIEUUcCRa8nPXsFZWd:Bom1qT2hrInQkpwfVzEy0nPXs2
  • TLSH
    T1AC67331032C92A9EF7CA8033F35C4D92CEA29DCA797678D8368C1795366521CC1E69FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojansalatstealerstealer

  • Detect SalatStealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4