sheetrat | 860386e3623ad3bbab4701ea455a46bcfa6b46e201c5c3a24769fcd5441d0c83

General

Target
WinSysHelper.exe
Size 9.6MB
Sample260504-mbr8pscs4l
SHA256 860386e3623ad3bbab4701ea455a46bcfa6b46e201c5c3a24769fcd5441d0c83
MD5 097bade22f4b8e8695b7340db8254e68
SHA1 afeace1db6f878cc4d9c42d0665c70cb519e8447
SHA512 dd9857222634e1cd60661594a5a73bb3918739cf3e5fc733d046a637cae40d3f601e13fe9762ec454717477babceb0e643e0f39f8242ba8aca5914718118da44
SSDEEP 196608:n9wpKdysCN8+ZjE2a4qAf+f3uKYIU/gpYbeEevzzPOVYLGQjRDTitfLuaVwujTds:nSCE97aFG+WKJU/UzTOV3YRDWtaaVbG/
TLSH
T18EA6D1A5A4AEA4F0C59FBB71D935795BDB3518224F5A21EB07103E840EB3394CDB8F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WinSysHelper.exe
- Size 9.6MB
- SHA256 860386e3623ad3bbab4701ea455a46bcfa6b46e201c5c3a24769fcd5441d0c83
- MD5 097bade22f4b8e8695b7340db8254e68
- SHA1 afeace1db6f878cc4d9c42d0665c70cb519e8447
- SHA512 dd9857222634e1cd60661594a5a73bb3918739cf3e5fc733d046a637cae40d3f601e13fe9762ec454717477babceb0e643e0f39f8242ba8aca5914718118da44
- SSDEEP 196608:n9wpKdysCN8+ZjE2a4qAf+f3uKYIU/gpYbeEevzzPOVYLGQjRDTitfLuaVwujTds:nSCE97aFG+WKJU/UzTOV3YRDWtaaVbG/
- TLSH
  T18EA6D1A5A4AEA4F0C59FBB71D935795BDB3518224F5A21EB07103E840EB3394CDB8F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2