Extracted

• • Target
    Client.exe
  • Size 359KB
  • SHA256 4e188fca4347c7c7b3e69de0007a82d7f84341a93ecf1e573c5c26177ea431c9
  • MD5 3723b2a6b87ab4f3ae71ab5cbf384b50
  • SHA1 8cf80df0748ec79bdc8090f0945c6b5103b65051
  • SHA512 03eb6a76a7ff13cf9bb3ef3b4bc550b5db223dfe7c378e9ba7929aa45ed2bd1782b2070d127ce86534b3232ca672a581b941c3d2cdf77d84f3e0b08ac689ef00
  • SSDEEP 6144:RdIWknpQtLivge6VlWT8b9YJXR0NTUVhbMMns:RhigPVle8OoG3
  • TLSH
    T15E74D51CFE91F805CE2A3E77CBE610105B7125C22F219246364AAFFD87653B658A35BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_sdyvvmzbelencxdiscoveryexecutionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence

    persistence

  • Sheetrat family

    sheetrat

  • Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1