Extracted

• • Target
    nliduaq3zbfeb4l3.exe
  • Size 817KB
  • SHA256 1ebe91ec32dacea8ef90ae7ed4f39676bf8e3c7edcaeb48f650e5113a461ab79
  • MD5 378eb13bd95adfd95059e8b3daeea422
  • SHA1 e1d14a280036b0be8fa7a795032436ec921e9d6a
  • SHA512 61d2dd9b74f811a91dc3ecce90f9d4390ecbba78cc51845de04b6d9e2ccb04697b6fbaab38133580f4dee9f39472d4e9e7162d31373d9ea8e962cb2121361e24
  • SSDEEP 12288:96LVgoiLGq0MGZ1f9e5q3FmO0oIsxilOW4xDuoEe51+g5:M1c5q1mjAn95meDR
  • TLSH
    T1A705E6243F948E41E5501A3E86BE2A20D73260F2231367473B0BF7A15D45ADEED6D3DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2