Extracted

• • Target
    111111.exe
  • Size 506KB
  • SHA256 3a6b77fd02102ec84b7028e24a310244a63d13bcdd25bed89570280367e5a727
  • MD5 f537823d47ca634e6961dc06d5f7ea2f
  • SHA1 3d96ba869932ea50e8785b7c8ca03460cb5c3be8
  • SHA512 d18edc9210b43bc291af768bb526e36672e0b2ba39bbb2c09edaee8c380ca3bd2e99efeef80ade50c767bd11d42268891d08b6b806d72f1a1e7a4db562dff47d
  • SSDEEP 12288:1eXjugg5QkLxq28oWWWEf6o/a7pUl4EMp:EsxqNWH6F9s4E
  • TLSH
    T1E4B407253FE58E00D591187E8A7E3609CB16E1F22502B347370AF6A25D459EEDE2C3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2