sheetrat | bd9aee63cbeb690f27982871729b90dc591e705408a5b1eba9313a11897f46f9

General

Target
EverythingCheker.exe
Size 5.7MB
Sample260703-lap7aaev4t
SHA256 bd9aee63cbeb690f27982871729b90dc591e705408a5b1eba9313a11897f46f9
MD5 26dd5139084a1418d50ade3c3dc44bd3
SHA1 254ad3637629e5c3e56c6985bab71c5636072224
SHA512 71a94f0785c8b32dfa2a3dbdec6f342bf27744b4209d2a90454ab8c54c4269cae0a14f130f781771b8ee95e3e2f55121558dd889b2696a1a99254a455f7a6737
SSDEEP 12288:dYFlYFH7ddzVKthnrB/5In+ae0HEVZlMsk3n9AoxB7c:AqnCoxa
TLSH
T17956DF4727F8C51DE3BEDA7498B3D0F04A77A426A91BDF091C8624B82A21F509DD076F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  EverythingCheker.exe
- Size 5.7MB
- SHA256 bd9aee63cbeb690f27982871729b90dc591e705408a5b1eba9313a11897f46f9
- MD5 26dd5139084a1418d50ade3c3dc44bd3
- SHA1 254ad3637629e5c3e56c6985bab71c5636072224
- SHA512 71a94f0785c8b32dfa2a3dbdec6f342bf27744b4209d2a90454ab8c54c4269cae0a14f130f781771b8ee95e3e2f55121558dd889b2696a1a99254a455f7a6737
- SSDEEP 12288:dYFlYFH7ddzVKthnrB/5In+ae0HEVZlMsk3n9AoxB7c:AqnCoxa
- TLSH
  T17956DF4727F8C51DE3BEDA7498B3D0F04A77A426A91BDF091C8624B82A21F509DD076F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery evasion execution sheetrat persistence privilege_escalation spyware stealer trojan adware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2