Extracted

• • Target
    4vp99do7r45gyy0q.exe
  • Size 52KB
  • SHA256 76bf761fa28f7a56bec5d5919e78be8f636985411be90c67f0af84f0935ae343
  • MD5 3bf3c33ca2645240a4d39eef8516d9a3
  • SHA1 0b93287a876ea8cf0ff63392f5162af926b86e47
  • SHA512 12449a618412919edcab090db76aae9fc501c57376df83d7dd1837397cb31a255c126f2f1e5352cc9d4e12cb2ca38b8afe5c9ff11daa866bb8cd730a1aa34966
  • SSDEEP 768:4i7n3iFlXwRZZ90WJzZXYBCKPu+F+gn26HObEeqwnV1eLLOXRElz:h7n3iXgRZZ90WrWG+FPObnNn7+LOhIz
  • TLSH
    T1A233290877C09A61D4BE02BA86A27360D336D2475C43E74F1ECBC0CE2E667D59946DEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryexecutionsheetratpackerpersistenceprivilege_escalationspywarestealertrojanadwareransomware

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2