Extracted

• • Target
    n7ibghc7qx94hsvr.exe
  • Size 443KB
  • SHA256 700f06eacb2a4b325dae9853cde16d18b90b29df68ddaee41b13ea02eeea7377
  • MD5 371eb5f797d93040b9310bf3efd79cad
  • SHA1 de86bd314808663808a2c4c7a53fe017cdf0b42d
  • SHA512 860dc2ffea9a402d8aa8bdc858c2f40220d7ce043fd946b11ae8e1e66051ff7a844d61c9573f7e152d9dddf2d004dfd0650523ab27ec20472ec196a1e85cf6d3
  • SSDEEP 6144:IUApZ5hyBblUJFqRTlVG+dnDryJyQB53BHA5RjOe8jJSgnIXd/MrwnraUAXrbIWs:I/5h/OTlVGWnD2JppHve8MdLraUWzev
  • TLSH
    T192A429253F988E14D540287ECA7E3A19CB12E1F125026347370AF7A15E459EEDE6C3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2