Extracted

• • Target
    ybgzqkjzvkjd.exe
  • Size 417KB
  • SHA256 66fffde4c64999b2f9a620f3c8707e1c9116a8e71aec2ee3838897b20027c8d8
  • MD5 8f2e0530bd077ebabdd89c340fbf1742
  • SHA1 82613f642a5d28ef4191ee4d9556cbb118301277
  • SHA512 e98a83b5eee78e2ef2faa41ff031fcb3219f8b3562bb9acbc8a9589386e86a2f545427838137130021b88f814ffc8341152c34ac1838e40ef0c64cdca8ca2814
  • SSDEEP 6144:aB/hgh3nu1kmFa6Xv4uDuxe6VlWT8b9lbsELEfesP2NbpyYbzDFTr:aBZ4Xskya1PVle8r9heir
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sheet_vxaqckwtpxtvhoiagsexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V2.0 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence

    persistence

  • Sheetrat family

    sheetrat

  • Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2