Extracted

• • Target
    Delta.exe
  • Size 257KB
  • SHA256 61abac79fc2c45f2e469d2c584225ce7076e564b5ad5a160e342a5048dfb2862
  • MD5 4ce08a7d6d4fa8617e63d27c80b8d02d
  • SHA1 336fee1a7880c181bfecf6a46c2349352320e01f
  • SHA512 be32a7115a1dbeb084880796e267e1fa57159cce6cfcca0fd32541bc09dc05bc4b9b90d1c33f3d3095a9dbb57999f2c7b1d0b4546bc5860efe635143fb838158
  • SSDEEP 3072:sOcl1bHZ3+T+1yEzVf8Vi2zJapGvIlBwZWUAmOBPW6DPmWtRBfG9W2eIfIxX5R2C:mNAIfEiFP3ULzDWtRBen4Xb2kkbVgP
  • TLSH
    T15744CF44B7C5C911E4AD2ABA8E02F3C84374BD13AD02F70A3E9AF39D1E327D4A551D96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdeltadiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2