sheetrat | 8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca

General

Target
x8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca.exe
Size 374KB
Sample260705-fvd2vsdv7r
SHA256 8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca
MD5 77d5aa9a1ab0457bfbf7a6589ebc953a
SHA1 cd687aaba979ac060f731be218a441af1e5f854f
SHA512 4c08cdf22fcd39bbe33217b9b5dd2be160300677fd14b71d5f85c4c4c3962a4e3adefa4496d69a8573d65646bb5c67f1463a043d1aa553857d00a02f57343fa0
SSDEEP 6144:xM6jlT9wz4ZoeETEW1gbpJA3KpSL0pDFLIKb:xMEd9ULePJA3KY0pG
TLSH
T149844A43BBD000BAD5BE453848735619A73AF8119B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  x8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca.exe
- Size 374KB
- SHA256 8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca
- MD5 77d5aa9a1ab0457bfbf7a6589ebc953a
- SHA1 cd687aaba979ac060f731be218a441af1e5f854f
- SHA512 4c08cdf22fcd39bbe33217b9b5dd2be160300677fd14b71d5f85c4c4c3962a4e3adefa4496d69a8573d65646bb5c67f1463a043d1aa553857d00a02f57343fa0
- SSDEEP 6144:xM6jlT9wz4ZoeETEW1gbpJA3KpSL0pDFLIKb:xMEd9ULePJA3KY0pG
- TLSH
  T149844A43BBD000BAD5BE453848735619A73AF8119B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan adware spyware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2