Extracted

• • Target
    Xeno-v.1.3.35.exe
  • Size 93.7MB
  • SHA256 a1773a96b9fb0e0bae91bfb1c8496bec3dc22ac57199a1b8cdfedff1463caa00
  • MD5 d361af0c6cf40a67a65382f9c94a57a0
  • SHA1 d22c781bde1ecd48637c35343f5ded9bcfd136e3
  • SHA512 465934dcc215c62521fc927601ff4a18566a708d6da979ca8ba2582ff239cbe0aee471f4c03a98b691ec2d589f048d3b8469488d2e00846fd7b22dda173bb3ea
  • SSDEEP 1572864:rdtd4OFU/JEMU2ifI2DqZnlDtCuRH3rrNU5II5+8L9iJzrTxaHHK:rvYEMUllDWXpRXrrNUb51kJzr1gH
  • TLSH
    T1F32833DF289F44FBDC804D749F0B1AE617B69E82E8428C3665D9354854F3F62602BAC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xenodiscoveryexecutionsheetratpersistenceprivilege_escalationtrojandefense_evasionransomware

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2