sheetrat | 12bff457eccb4a0e1bdf00669c488f5e84868ca1cdf9421842e0addd72f78b83

General

Target
WarpClient.exe
Size 405KB
Sample260628-pgsgrshs7p
SHA256 12bff457eccb4a0e1bdf00669c488f5e84868ca1cdf9421842e0addd72f78b83
MD5 48dba49931b2f65c41bd3ba1e88f57ea
SHA1 4f3ce90140401ec52cfe13e6f2f906d73ed141be
SHA512 2a4e29151d52ed8c6f17386f0c3cd7db25b7d635df51c83c0f6358fdeadad7d47c6a57acae3a2ce4126390b37d010acd7c6ef5e3f694094d3dd8611d559f2431
SSDEEP 6144:jenC1cR57w0wHi49wz4ZoeETEW1gbpJA3KpSL0pDGlk7zbaz5:jenCeR57w0J49ULePJA3KY0p+2yz5
TLSH
T103944942B7D50479E5BE463848736A14973AF8214B72EBDF1A9404ED0E27BC2DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WarpClient.exe
- Size 405KB
- SHA256 12bff457eccb4a0e1bdf00669c488f5e84868ca1cdf9421842e0addd72f78b83
- MD5 48dba49931b2f65c41bd3ba1e88f57ea
- SHA1 4f3ce90140401ec52cfe13e6f2f906d73ed141be
- SHA512 2a4e29151d52ed8c6f17386f0c3cd7db25b7d635df51c83c0f6358fdeadad7d47c6a57acae3a2ce4126390b37d010acd7c6ef5e3f694094d3dd8611d559f2431
- SSDEEP 6144:jenC1cR57w0wHi49wz4ZoeETEW1gbpJA3KpSL0pDGlk7zbaz5:jenCeR57w0J49ULePJA3KY0p+2yz5
- TLSH
  T103944942B7D50479E5BE463848736A14973AF8214B72EBDF1A9404ED0E27BC2DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence privilege_escalation trojan adware ransomware spyware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2