Extracted

• • Target
    xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe
  • Size 4.3MB
  • SHA256 dacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944
  • MD5 7c2805150c8a4d3effc43ccac18048f5
  • SHA1 d6174c96fec5ae3cd9fecfb2fe9d6e8a2b794b84
  • SHA512 b4218ee3ce799b049789b6210c631998821cc812f0aa28127ee627c9e519bd2cdb5060c3c11bdea396d082652f63bf7072d51638acabcf72ec10d05c4fa6fdbd
  • SSDEEP 98304:jkFONNRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:jMqR/gmeOqv7Ac9F0kB
  • TLSH
    T1DB26010CFE91E855CD2A7D77CEE601008B7178C1AF21964B32555FEE8F263B259A623C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_kfoyvjaghimeycwnnxcredential_accessexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2