sheetrat | 098fde601ecec7610152300b0f2b5f4b5786405ffb117e6ca2129bf7151f5471

General

Target
Madium-Executor.exe
Size 388KB
Sample260615-krksfsct8l
SHA256 098fde601ecec7610152300b0f2b5f4b5786405ffb117e6ca2129bf7151f5471
MD5 2a40e59a97a448b1e262616005a5e5b9
SHA1 f209c0e01f4bc619a027675fbce56352a19f089f
SHA512 37a861c14f6cad4200460bc11d37b59d91d1dfd3d78baa4b4612162bb7752e6b7a749fbae1e3d2d0c98a0db22b55b59a6352be037c31814855ff833620154df8
SSDEEP 6144:Ef8SBjon9wz4ZoeETEW1gbpJA3KpSL0pD57JGb/:Ef8mjon9ULePJA3KY0p5Jg
TLSH
T1D3845A43B7D400B9E5BE467848739615A73AB8218B72EBDF169404ED0E27BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Madium-Executor.exe
- Size 388KB
- SHA256 098fde601ecec7610152300b0f2b5f4b5786405ffb117e6ca2129bf7151f5471
- MD5 2a40e59a97a448b1e262616005a5e5b9
- SHA1 f209c0e01f4bc619a027675fbce56352a19f089f
- SHA512 37a861c14f6cad4200460bc11d37b59d91d1dfd3d78baa4b4612162bb7752e6b7a749fbae1e3d2d0c98a0db22b55b59a6352be037c31814855ff833620154df8
- SSDEEP 6144:Ef8SBjon9wz4ZoeETEW1gbpJA3KpSL0pD57JGb/:Ef8mjon9ULePJA3KY0p5Jg
- TLSH
  T1D3845A43B7D400B9E5BE467848739615A73AB8218B72EBDF169404ED0E27BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit costura defense_evasion discovery evasion execution exploit sheetrat packer persistence ransomware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2