Extracted

• • Target
    2drebcgxsr6hzlry.exe
  • Size 463KB
  • SHA256 90499acbe196edbb4cbf7f1827101ff18045fcb583b6113f91ba33a09940dd23
  • MD5 bc08f9e093bed073b2448a9307e5eb7a
  • SHA1 cd91c95db45a4dc2d66f5c1f45c15bd7e1cbf06e
  • SHA512 4ebe6f668f7ba17aac0b0c6be91f7468a505b062dce8f7f208e42036998e87cabf8bdef95f4b367205f3fcf507ac8d21c55ac92b7ee1587e5ffa3e6d594ffb73
  • SSDEEP 6144:f73VPuOrHA+9qcWiM1octhqFjRvTkB+4um0nD9mriQNAScrTdpMsfVP6QUioGswb:f7VPV3M68qFNvoum0nD9mXztbT6rc
  • TLSH
    T1B9A428293FA58E10D544243ECA7E7A09CB52E0F125126307370AF6E55D459EEEE2C3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3