Extracted

• • Target
    Nursultan.exe
  • Size 511KB
  • SHA256 7f69c9bba8816d67f61eebbd28e2cda106587e822f59c5e09ebf064bccfdb9a0
  • MD5 05d6bb14dda222de97dfb0037296b66d
  • SHA1 e8a146c531e5f8ad750a9852683a84d20ded8449
  • SHA512 a845018a51f1b5ba447c72452f2a70ae8e6ab878936909eef6ef1aba71a24f55015d3b170bfe57653b6b3a8479c271a73b832ba89c88d62929204a8098446636
  • SSDEEP 12288:0yjXA+Sj34rhgqv47ZYqAyXbP0x9+zbN:mwhf6q/qbP0G
  • TLSH
    T127B429253FA48E00D580247ECA7E7619CB12E4F2250263473746F7A26D459EEEE2D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2