Extracted

• • Target
    spoofer/HWID SPOOFER.exe
  • Size 309KB
  • SHA256 74b7de2779faec002d80d97a5b4047d3d12524d1db3cbaa4ef5e58d8f2586401
  • MD5 a51a9d362abe5eac98708092c82b7ac7
  • SHA1 433e43e25f6ca0e6b56f8b0beaff47c0dedac9dd
  • SHA512 245d7004fb530f41787fee0177a4e3cb460b4a51485913c7263335cbe0d499e7f818f9102c3c1c8ed99ec2e8e1e2b47767811d4816170b752826a47787d9bd63
  • SSDEEP 3072:RTq0v9fpnTNpbZ4/sny+GZx+Z7W1NeN3w/jhlhE1Z8Nig98nK7Wpq6ptNHGUAjF4:kiTT6pGZCe6VlWT8b99E/e+QN8b2z
  • TLSH
    T19D64C40CFE91E804DD6E3D77CBE610149B7121C22E21928272996FFD8B5637758E62BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_avxoguxepirbwqriqexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1