Extracted

• • Target
    0qbuoyx1abygv4ey.exe
  • Size 373KB
  • SHA256 b734bfdaad9f9f745379d1231bb15715ae227dfb52b637a7d51624a7a8d16646
  • MD5 24d95c6052d03b268154e6d0e3ff510b
  • SHA1 5280baf2fb3d4675bf1e0be813118434c15f3f8d
  • SHA512 3e77e50403890a4084ec4e37791efb52897a9dbf31923a112fe9fa46771b888c3d91373f4630c132d439b3050853fba047e5a177a3cb3266b8b1179727abe53b
  • SSDEEP 6144:ylqJoOg+hMRITlhQbjusw6v6aP0IKfVrMu/xs7Ew30TlbN2wi6j7UXM:o4oOg+xYPcfKex830Bi6jo
  • TLSH
    T15784C6257FA48E00D580197ECABE3609CB16E0F22502A347370AF7A25D459DEDE6D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2