sheetrat | 356a4e5c3ca7b2d7033af9e0b1436604c36416a5acadb56586e52c90275d0a72

General

Target
vm.exe
Size 33.2MB
Sample260608-xtbc1se19j
SHA256 356a4e5c3ca7b2d7033af9e0b1436604c36416a5acadb56586e52c90275d0a72
MD5 04e4185dc1341de59d256a9d9034e3af
SHA1 f454ea30f8e4d340f8d4f8bc6f19d0594b9360a4
SHA512 c47fecf58995afe9aaa96039f058aa2d5e287efc349888df92b1dc5236998cc826aa07431aca968da95529869fff577b711dc8fc42e9c64fa414ea7dd3b93005
SSDEEP 786432:A8G41CEN8uDfWpOiSX/TjslDce3kZ+RrIs:RnCEN8ZpOiSTjskZyIs
TLSH
T1017733831472E9BCE368C8B2069FD9F085DB561815A7DF502E4D227C3981E29BED346F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  vm.exe
- Size 33.2MB
- SHA256 356a4e5c3ca7b2d7033af9e0b1436604c36416a5acadb56586e52c90275d0a72
- MD5 04e4185dc1341de59d256a9d9034e3af
- SHA1 f454ea30f8e4d340f8d4f8bc6f19d0594b9360a4
- SHA512 c47fecf58995afe9aaa96039f058aa2d5e287efc349888df92b1dc5236998cc826aa07431aca968da95529869fff577b711dc8fc42e9c64fa414ea7dd3b93005
- SSDEEP 786432:A8G41CEN8uDfWpOiSX/TjslDce3kZ+RrIs:RnCEN8ZpOiSTjskZyIs
- TLSH
  T1017733831472E9BCE368C8B2069FD9F085DB561815A7DF502E4D227C3981E29BED346F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2