Extracted

• • Target
    KovaaK's.url
  • Size 222B
  • SHA256 445ec9236416836664d0c8e2b00fb5ba6dc26322627cb78d46d44fb1f610884e
  • MD5 feed7dd35769d870a5568e611ec81e26
  • SHA1 731ad0f00fc3bb5a6c514370689d3287b3ddc1db
  • SHA512 1c4b28c671e36656b7bd5497b2b176a6509aa86eeb551ec3e75e84b94e8f9c0cb5d18a1bd80980451c1be13d24d8adfb4098eb8ad8c89e696ff2c56ea3b4a59e
  • TLSH
    T1F2D0A7648A468191D39394070164BC51A84CB55628CECC8E52C1DB8A1D856C59844E29
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  costuradiscoveryexecutionsheetratpackerpersistenceprivilege_escalationransomwaretrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1