sheetrat | 9d4662cd8502aec3233cab840ce3514c9096478b9b14abb125895de7739b9e93

General

Target
445eyu0r163e2alm.exe
Size 5.2MB
Sample260623-zleftags8l
SHA256 9d4662cd8502aec3233cab840ce3514c9096478b9b14abb125895de7739b9e93
MD5 9ab78beba0c1acb5024276b8278937da
SHA1 d12b4b404bf23ef7c7b70c859998c2b4e5033301
SHA512 ff2ad73f93ddfbc4b64d0add25eaeafd688e9965b7077d097baa38bdfcb9d7fdc558dbed8d0ca6fa023050f0ef92f04bc3bddec8a9dce6f20018456700ed2382
SSDEEP 12288:MLuUaCL/I1CiO9GsMV0akDn6Rxs67cRTQACL:
TLSH
T1A446239B8671D90CDB5CD8B7AA03C6F51BA3C01D2847AF451ED861B8D9EBE861EC110F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  445eyu0r163e2alm.exe
- Size 5.2MB
- SHA256 9d4662cd8502aec3233cab840ce3514c9096478b9b14abb125895de7739b9e93
- MD5 9ab78beba0c1acb5024276b8278937da
- SHA1 d12b4b404bf23ef7c7b70c859998c2b4e5033301
- SHA512 ff2ad73f93ddfbc4b64d0add25eaeafd688e9965b7077d097baa38bdfcb9d7fdc558dbed8d0ca6fa023050f0ef92f04bc3bddec8a9dce6f20018456700ed2382
- SSDEEP 12288:MLuUaCL/I1CiO9GsMV0akDn6Rxs67cRTQACL:
- TLSH
  T1A446239B8671D90CDB5CD8B7AA03C6F51BA3C01D2847AF451ED861B8D9EBE861EC110F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2