General
- Target lf1t99s3j54ra403.exe
- Size 44KB
- Sample260701-yhcmdadw9r
- SHA256 82337d98b955fe231a4b0dd2b4ad36fb8835f6a8a1a40c40234ab696e40bb4fe
- MD5 4c0e32117d823990f3eaea9a9e02dad8
- SHA1 f3adc03419f1a1187fb96635fa145ddc531c1c05
- SHA512 9a3750d5c208e9620b25e742e389abebbe5a50d44c19e453e4c3ccf00cdc43db58518fa6592a87e9a7094c45d3e01222686fd2572715692ee992addb284b39b7
- SSDEEP 768:oB/wPTZB21xEHUs1zioimgOkkKvObyCmw3SCEJ+mrA56ZS0911wZYBxkD:oB2TaEHbioTNQOblx6k09bwaxc
- TLSH T1BF233A0137D88922D28F0ABD57A663CA8231C3736A42D74E7CEB5DE065837D68706EC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sheetrat
Version
-
1.8
C2
-
CapYy-56522.portmap.host:56522
Mutex
Attributes
-
anti_virtual
false
-
certificate
tkhgf1gpwzgqkd5e0c2a2a
-
exclusion_wd
false
-
hidden_file
true
-
install
true
-
install_watch_dog
false
-
key
j34reh1qns
-
path_watch_dog
iz^02sm3mq3fyei50v%a9g$nq@k
-
pump
false
-
rootkit
false
-
task_watch_dog
e5xio97)6cbi#i4f(*pf6d%mg!!
-
use_install_admin
false
-
user_init
false
Targets
-
- Target lf1t99s3j54ra403.exe
- Size 44KB
- SHA256 82337d98b955fe231a4b0dd2b4ad36fb8835f6a8a1a40c40234ab696e40bb4fe
- MD5 4c0e32117d823990f3eaea9a9e02dad8
- SHA1 f3adc03419f1a1187fb96635fa145ddc531c1c05
- SHA512 9a3750d5c208e9620b25e742e389abebbe5a50d44c19e453e4c3ccf00cdc43db58518fa6592a87e9a7094c45d3e01222686fd2572715692ee992addb284b39b7
- SSDEEP 768:oB/wPTZB21xEHUs1zioimgOkkKvObyCmw3SCEJ+mrA56ZS0911wZYBxkD:oB2TaEHbioTNQOblx6k09bwaxc
- TLSH T1BF233A0137D88922D28F0ABD57A663CA8231C3736A42D74E7CEB5DE065837D68706EC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.