Extracted

• • Target
    n7ibghc7qx94hsvr.exe
  • Size 443KB
  • SHA256 700f06eacb2a4b325dae9853cde16d18b90b29df68ddaee41b13ea02eeea7377
  • MD5 371eb5f797d93040b9310bf3efd79cad
  • SHA1 de86bd314808663808a2c4c7a53fe017cdf0b42d
  • SHA512 860dc2ffea9a402d8aa8bdc858c2f40220d7ce043fd946b11ae8e1e66051ff7a844d61c9573f7e152d9dddf2d004dfd0650523ab27ec20472ec196a1e85cf6d3
  • SSDEEP 6144:IUApZ5hyBblUJFqRTlVG+dnDryJyQB53BHA5RjOe8jJSgnIXd/MrwnraUAXrbIWs:I/5h/OTlVGWnD2JppHve8MdLraUWzev
  • TLSH
    T192A429253F988E14D540287ECA7E3A19CB12E1F125026347370AF7A15E459EEDE6C3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojandefense_evasionadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2behavioral3behavioral4