sheetrat | 7b2de549708ebc6101f90650794691e4cc85164fc002f1bb6da47f23f51fa98b

General

Target
x7b2de549708ebc6101f90650794691e4cc85164fc002f1bb6da47f23f51fa98b.exe
Size 375KB
Sample260709-mk4yvshw91
SHA256 7b2de549708ebc6101f90650794691e4cc85164fc002f1bb6da47f23f51fa98b
MD5 89e9c9d4543c2027a0caa898813c3401
SHA1 17337bc220676e2e867dc018f14e0c16d60c5aa4
SHA512 f216bdb1acf323d7b4b71268ef3c47362fe84c2a37418c2d323b3a7de7fa3bce98e3590236bd5df153d8ffd8a6e262d31c1da42344841a58b7a7a37d8c3b7937
SSDEEP 6144:RP65xO9wz4ZoeETEW1gbpJA3KpSL0pDHLsKbb:RP629ULePJA3KY0pbgs
TLSH
T1EF845A43BBD100BAE5BE453844735619A73AF8218B62EBDF169404ED0F26BC5DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  x7b2de549708ebc6101f90650794691e4cc85164fc002f1bb6da47f23f51fa98b.exe
- Size 375KB
- SHA256 7b2de549708ebc6101f90650794691e4cc85164fc002f1bb6da47f23f51fa98b
- MD5 89e9c9d4543c2027a0caa898813c3401
- SHA1 17337bc220676e2e867dc018f14e0c16d60c5aa4
- SHA512 f216bdb1acf323d7b4b71268ef3c47362fe84c2a37418c2d323b3a7de7fa3bce98e3590236bd5df153d8ffd8a6e262d31c1da42344841a58b7a7a37d8c3b7937
- SSDEEP 6144:RP65xO9wz4ZoeETEW1gbpJA3KpSL0pDHLsKbb:RP629ULePJA3KY0pbgs
- TLSH
  T1EF845A43BBD100BAE5BE453844735619A73AF8218B62EBDF169404ED0F26BC5DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2