sheetrat | 827f8b6b929845378fe3b1c0a382953b4f32416ad9cb5f4d786e4ae706bb4ba9

General

Target
Realtek.exe
Size 402KB
Sample260628-ws12lsaz7y
SHA256 827f8b6b929845378fe3b1c0a382953b4f32416ad9cb5f4d786e4ae706bb4ba9
MD5 d367aa4a63f63e6b2197787d0949fa1a
SHA1 a579fb9eb2e9601608ed698fad4966f5f2e9e999
SHA512 597ecf23a06547351ab9f1ca114b6f0e1cc8ae91e7ae0b9198cef7e17e54f7377ff1eed47ba2045300a408aa28096487ea21229c468692fb503de6b34323423a
SSDEEP 6144:ijcGOX8sr1Tx9wz4ZoeETEW1gbpJA3KpSL0pD9DSfmKYbt+:iAGi8sr199ULePJA3KY0psf3E+
TLSH
T108944A43B7D504BAE5BE463844735615A73AB8214B72EBDF1A9404ED0E23BC2DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Realtek.exe
- Size 402KB
- SHA256 827f8b6b929845378fe3b1c0a382953b4f32416ad9cb5f4d786e4ae706bb4ba9
- MD5 d367aa4a63f63e6b2197787d0949fa1a
- SHA1 a579fb9eb2e9601608ed698fad4966f5f2e9e999
- SHA512 597ecf23a06547351ab9f1ca114b6f0e1cc8ae91e7ae0b9198cef7e17e54f7377ff1eed47ba2045300a408aa28096487ea21229c468692fb503de6b34323423a
- SSDEEP 6144:ijcGOX8sr1Tx9wz4ZoeETEW1gbpJA3KpSL0pD9DSfmKYbt+:iAGi8sr199ULePJA3KY0psf3E+
- TLSH
  T108944A43B7D504BAE5BE463844735615A73AB8214B72EBDF1A9404ED0E23BC2DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2