sheetrat | reallycrack[.]exe

General

Target
reallycrack.exe
Size 795KB
Sample260708-tgadeab19j
SHA256 086f9a7bfee4dffac78703e16748ad4c70e6890e5bcd72031918e7982ad0e641
MD5 c0d8774d2726ece37f2e545a0daab3d2
SHA1 4bfdb2cc3b8e81f11f94dc157535e60417d7b8ba
SHA512 a9326c930f34eda4434e05b9ef44bc43a16495e642abb78984efebc6adf3bfe7a51f8260f89adbf75cb3f8e408e010866f272d3efba5e72fb9f5f5ee0a4febd7
SSDEEP 6144:sDk+yIlu5fZr8+3r2090p+hDbfjFilVaBfWNj32AYA/ESMSIFxjRWKaGPJun5W1:sDk+VA++3FxoVqfWF325mMSIDJRt
TLSH
T19D05A559BE11ED05CD372AF28AD1D37017710E817B12C21126B5BEE7FAE46E61E920EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

C2

zykliya2513-40294.portmap.host:40294
u|]2Tk6vqE3:NLp*MQ=< RVd.lI+mFG~[HZ/A-Yg"Oebh?{w1&0D5> z@Jas!t4_}C#Uf

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v4

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
reallycrack.exe

File Explorer

reallycrack.exe

.exe 795KB

reallycrack.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 086f9a7bfee4dffac78703e16748ad4c70e6890e5bcd72031918e7982ad0e641
MD5 c0d8774d2726ece37f2e545a0daab3d2
SHA1 4bfdb2cc3b8e81f11f94dc157535e60417d7b8ba
SHA512 a9326c930f34eda4434e05b9ef44bc43a16495e642abb78984efebc6adf3bfe7a51f8260f89adbf75cb3f8e408e010866f272d3efba5e72fb9f5f5ee0a4febd7
SSDEEP 6144:sDk+yIlu5fZr8+3r2090p+hDbfjFilVaBfWNj32AYA/ESMSIFxjRWKaGPJun5W1:sDk+VA++3FxoVqfWF325mMSIDJRt
TLSH
T19D05A559BE11ED05CD372AF28AD1D37017710E817B12C21126B5BEE7FAE46E61E920EC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Sheetrat obfuscated V1.8 and higher

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bb:e0:cb:49:8d:f4:4a:12:16:fb:88:99:e5:8c:30:af:32:ec:ce:79:ee:1e:aa:9e:1b:a4:21:5a:7f:41:15:49

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 2, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

438830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

reallycrack.exe

PE Signature issue

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

reallycrack.exe

PE Signature issue

mscoree

dotnet