sheetrat | kw96deakv72l1jlw[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
kw96deakv72l1jlw.exe
Size 198KB
Sample260619-xrtftab16y
SHA256 f97af03836cf012cab1e2dabdb5079fb9c13faac9dd09bbd771332dd54ad572b
MD5 884b07b9cd6b3a04c1ab96a8d69f83d8
SHA1 9da6cf4a1a8017b40474f7453109cb2fe03167f9
SHA512 6e5b37c08c9ecb0c21c8d90e40b32d16cd0f8c2a3310f667c7a9c305b68e94028d18a5f60991e0a8f70c39a4333d50380b5609758cd3d0cf264439232d1f2f55
SSDEEP 6144:SjasIhFBC//2C9dX3MCar0jm49OMjbJwlD:G/Ia2iB3Ir0jb9OMClD
TLSH
T1AE14F1497BD4D611C47E0279D7F6B385C734B2833A81D3032ECAA1C55E9B7C6A498CEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Attributes

anti_virtual
false
certificate
vjli11lxjjzegjtjb6kfgmpvl9bcb
exclusion_wd
true
hidden_file
true
key
ndkjx53m6l
path_client
%ProgramFiles%\Search.exe
path_watch_dog
%Windows%\xSearcher.exe
pump
false
rootkit
0suevo9zupxj6hw6pzydhwsk2dcbl3
task_client
ShellHost
task_watch_dog
CookieManager
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v1

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
kw96deakv72l1jlw.exe

File Explorer

kw96deakv72l1jlw.exe

.exe 198KB

kw96deakv72l1jlw.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f97af03836cf012cab1e2dabdb5079fb9c13faac9dd09bbd771332dd54ad572b
MD5 884b07b9cd6b3a04c1ab96a8d69f83d8
SHA1 9da6cf4a1a8017b40474f7453109cb2fe03167f9
SHA512 6e5b37c08c9ecb0c21c8d90e40b32d16cd0f8c2a3310f667c7a9c305b68e94028d18a5f60991e0a8f70c39a4333d50380b5609758cd3d0cf264439232d1f2f55
SSDEEP 6144:SjasIhFBC//2C9dX3MCar0jm49OMjbJwlD:G/Ia2iB3Ir0jb9OMClD
TLSH
T1AE14F1497BD4D611C47E0279D7F6B385C734B2833A81D3032ECAA1C55E9B7C6A498CEA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0d:f3:7d:3e:46:60:d0:4f:11:ff:4b:a3:68:9d:9a:ad:02:ff:60:12:88:e9:56:49:5f:6d:83:b6:6a:29:a6:f9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

Chains

Oct 26, 2022

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

Serial Number

d1:d9:b4:e7:4c:7f:5f:41:d5:d9:60:fd:a6:f9:22:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2022 - Oct 12, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

198014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kw96deakv72l1jlw.exe

PE Signature issue

mscoree

dotnet