Extracted

• • Target
    4vp99do7r45gyy0q.exe
  • Size 52KB
  • SHA256 76bf761fa28f7a56bec5d5919e78be8f636985411be90c67f0af84f0935ae343
  • MD5 3bf3c33ca2645240a4d39eef8516d9a3
  • SHA1 0b93287a876ea8cf0ff63392f5162af926b86e47
  • SHA512 12449a618412919edcab090db76aae9fc501c57376df83d7dd1837397cb31a255c126f2f1e5352cc9d4e12cb2ca38b8afe5c9ff11daa866bb8cd730a1aa34966
  • SSDEEP 768:4i7n3iFlXwRZZ90WJzZXYBCKPu+F+gn26HObEeqwnV1eLLOXRElz:h7n3iXgRZZ90WrWG+FPObnNn7+LOhIz
  • TLSH
    T1A233290877C09A61D4BE02BA86A27360D336D2475C43E74F1ECBC0CE2E667D59946DEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasionexecutionsheetratpackerpersistencespywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2