General
- Target yox5g5amjnr1z39b.exe
- Size 4.8MB
- Sample260619-st6fyahs4k
- SHA256 73da18615e57466240f56b0f883d06263b39d9b60af1ed0cf2cee2d8c7d50fc4
Score
10/10
Malware Config
Targets
-
- Target yox5g5amjnr1z39b.exe
- Size 4.8MB
- SHA256 73da18615e57466240f56b0f883d06263b39d9b60af1ed0cf2cee2d8c7d50fc4
Score10/10-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies security service
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Stops running service(s)
-
Windows security modification
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1