Extracted

• • Target
    PulseVisClient by tgk.exe
  • Size 269KB
  • SHA256 5b94a3b7e7c805d17886e779cd0859d8f2cf8913c6380313139773de26ed9f0a
  • MD5 113eb2621766e945a50fc826f7c63841
  • SHA1 82557006fa4cee8d314251b4ef94d26190fbdf67
  • SHA512 fbdd3b8e497bcae6bd516520891c51a7741a23b68860cd13f7561d02d371b976f8dea414f1abca7e3f887a6713f55fdbcad7667e9de2f524e98b84500d35c096
  • SSDEEP 3072:rpJ1VDYYPhWRRMxuKnxyINeN3w/jhlhE1Z8Nig9TaB3CTBbbbtfd1HXuV:/1VDYAv/yUe6VlWT8b9Hbpdc
  • TLSH
    T1D844D61CFF91E805CE693C37CBE610148B7126C22E219643764A6EFD8B553BA58F61BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_xxedegaflbnmadjtlexecutionsheetratpersistenceprivilege_escalationtrojandiscovery

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  behavioral1behavioral2