Overview

overview

10

Static

static

10

0iqqncmt5tngqkfe.exe

windows10-2004-x64

10

0iqqncmt5tngqkfe.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0iqqncmt5tngqkfe.exe
  • Size 184KB
  • Sample260622-mvs94sa14l
  • SHA256 39eca0ff5979e06f84fa63f6d4e45b7a9eeee83995e8f4f1bc98b1c4c8a6a06c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratproverkatrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 1.8

Campaign

  • proverka

C2

  • ortbuddy.dev:42838

Mutex

  • b$&pw!7mhwh#wqw

Attributes
  • anti_virtual

    false

  • certificate

    bs3ur0rwav21psnr7sokfjz6ma0v5yj

  • exclusion_wd

    *2beqzg25l

  • hidden_file

    k+!ge*y_

  • install

    false

  • install_watch_dog

    7n2b_&m9m#jnayj49g$645fdsp_w^*v

  • key

    i70ma2ber02rhbf5ue76r

  • path_client

    *4++#otu$l&w(u&*o^z*ef

  • path_watch_dog

    9uvfm@@lbyw#gx1#n5_52i&

  • pump

    vde6%zhklnh450)!o@xd7kkn0(#o#g7

  • rootkit

    mQ((-_%-m

  • task_client

    3h7_i_u6m

  • task_watch_dog

    mwdncaqg^&)0tu%)#g2+wg0!szsa52

  • use_install_admin

    evwz@za+$51*w93)+(3(!7idiznpg

  • user_init

    6l95jg0m_@dnbt^i@!p$3p_y($gqb

Targets

    • Target
      0iqqncmt5tngqkfe.exe
    • Size 184KB
    • SHA256 39eca0ff5979e06f84fa63f6d4e45b7a9eeee83995e8f4f1bc98b1c4c8a6a06c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    proverkasheetrattrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks