Extracted

• • Target
    1ns3gv97oviwf90m.exe
  • Size 372KB
  • SHA256 1a86daee4f4b5134460e34ab33690037fc20e61237af09e817280deb67e2b72f
  • MD5 b544b380d59fb1c1ba3483b3dafdc0e6
  • SHA1 367d647811d073e5502dd4a7d7883c855d2bbc65
  • SHA512 226d226d5d974fb580a0973620151bdf3b3139075aec85251841f067693dda28cf01f0dcfc34552d70b5304f345fc82fac00b02bbfa8872dc90e043bae960baa
  • SSDEEP 6144:QRuJ3XjMe7hTEIKlUICtH2ZhWBzK5YtZeeYUq7KbBuj1Y7sKrd:ywXjN1SYe5EZeD7Suj2sK
  • TLSH
    T16F84A5257F958E00E580297ECA7E3609CB16E4F21602A347370AF7A25D459DEDE2C3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojanadwareaspackv2modiloaderransomwareupx

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • ModiLoader Second Stage

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2