sheetrat | cbd31f292ae1c4acb3275514358367e8d2a0ecdc2d1894186095dfd28fb37834

General

Target
test.exe
Size 5.3MB
Sample260604-xtgvssds7n
SHA256 cbd31f292ae1c4acb3275514358367e8d2a0ecdc2d1894186095dfd28fb37834
MD5 b341243913ec2b07ceb7af1ce438dc01
SHA1 48bb0b5c7dfceb8c23f2d259902a14757cd5bcab
SHA512 8d982a153e71c65180f4088d6baa34662ae10fa1c354d2c1c924c1e81afb4eab97f4af7fe5da348928bc230abe49f159392a6731e125ceb50b7423ed2da423c7
SSDEEP 12288:RzBmrPSDZAHhZGCFDQjWj+H2fvtOA1B+15FS:
TLSH
T17F46236F8BF5D9ACDB99E432B157C4F9B6B7A14800870F126E6842B2846DC11AFD0D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  test.exe
- Size 5.3MB
- SHA256 cbd31f292ae1c4acb3275514358367e8d2a0ecdc2d1894186095dfd28fb37834
- MD5 b341243913ec2b07ceb7af1ce438dc01
- SHA1 48bb0b5c7dfceb8c23f2d259902a14757cd5bcab
- SHA512 8d982a153e71c65180f4088d6baa34662ae10fa1c354d2c1c924c1e81afb4eab97f4af7fe5da348928bc230abe49f159392a6731e125ceb50b7423ed2da423c7
- SSDEEP 12288:RzBmrPSDZAHhZGCFDQjWj+H2fvtOA1B+15FS:
- TLSH
  T17F46236F8BF5D9ACDB99E432B157C4F9B6B7A14800870F126E6842B2846DC11AFD0D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1