Extracted

• • Target
    ghDJTIDefTzQ9oLY.exe
  • Size 180KB
  • SHA256 fc70c5d9119f055f2138a466184e89a8f4f58dd9eeb068da204f9970452f3d79
  • MD5 d8d430fa7fa94ae737d855d21d350d72
  • SHA1 92e6432e9769cebd8125b383636ad2002f0dcd2f
  • SHA512 6406939428fedf060506925d889325aaf380a6d654d1417dec2af1f43b4298c7f752bcfc22aa9700d07cdea4fa474ee4df925cb5eb79241f037bfa823856de64
  • SSDEEP 3072:O/XPEVgN/KERn29bvgX8aWd4pP0BBKYmJFl0TnGAg7YYV7UYc22jJObodn:6EGRaPCcZawGT1U68Ib
  • TLSH
    T18904E100BF8249B6C7AD15F696D562ACA7319363B643EB0A2CE702D102327D5E543DFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitmclientdefense_evasiondiscoveryexecutionsheetratpersistencetrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2