Extracted

• • Target
    Client1.exe
  • Size 428KB
  • SHA256 1930056604624a8ba682b9c1874cd5bcab34dbb792f4e81e64251158c1bb5c46
  • MD5 10314e2b5e7da89fc8d2d0070f5ba0ed
  • SHA1 fdc7b7d05dfc037825dad011db8854dc9d4d1d17
  • SHA512 967bcb77a8240d9dd752e6ae8227843d1a8e3cdd002b6086c3c08a8feaed8240c979e59557a1a2ffb29f11c7745eaa24dd9a16bb946a2bf94c70b8045eb744a4
  • SSDEEP 6144:IhU2UiF2Be6VlWT8b96XYqn1i8iusSXAAbDJr13EogqyTHu:IKtiF2BPVle8erKBNOJZE15TH
  • TLSH
    T1C594C40CBE90E804CD2A3D73CAE5D430DB7135C12E11928E765A6EEF4B673E649A617C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_lchunwmieuexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2