Overview

overview

10

Static

static

10

59116hrqxviogotq.exe

windows10-2004-x64

10

59116hrqxviogotq.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    59116hrqxviogotq.exe
  • Size 210KB
  • Sample260627-wp3q2acs4w
  • SHA256 498c20011c1f2b772c5e8868974e923ca278f0663dd2e88923d1d6d49f88334c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratadwarepersistenceransomwarespywaretrojan

Malware Config

Extracted

Family

  • sheetrat

Attributes
  • anti_virtual

    .f\Af3<]TOg-jpa11H#Td)vv

  • certificate

    c5a1Ag-.R5.g4dVZU%b$g1vv

  • hidden_file

    ,b8Hc<>b I}:_+QQ#B=s+Vvv

  • key

    uo6>/XB@_3j1\kI5X=1=VI#|h=V]&L3@I+kWbLgc'iQv

  • path_client

    uE+H$VO|G.uT#b}bZ'\-oH67@3<<:'jgi1\ EZuHU.Zv

  • path_watch_dog

    W9&}@pB18hsR<OB"uWX$H>j9\pUs:._<\X+RUp$@HX v

  • pump

    oHAef+Ua~"9_-OG*'%#H\Vvv

  • rootkit

    2]==8j~82

  • task_client

    g}X}s+1o@}#]fHi$6E*AG&14pQ>34Q .Z7@&p+-A9W v

  • task_watch_dog

    &cTs+1,UG'g5*LcWZhp9-1vv

  • user_init

    & 84#W$|+#LEU8W>:].R@:+OofQ<:i"HeL7o8)]k51Zv

Targets

    • Target
      59116hrqxviogotq.exe
    • Size 210KB
    • SHA256 498c20011c1f2b772c5e8868974e923ca278f0663dd2e88923d1d6d49f88334c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    sheetrattrojanadwarepersistenceransomwarespyware

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks