sheetrat | 36e919a8ce2d4a449369cfcb66ae8da0b5054c9fcc70201e954168105aef9941

General

Target
RealtekHDAudio.exe
Size 402KB
Sample260709-p81mfsb14t
SHA256 36e919a8ce2d4a449369cfcb66ae8da0b5054c9fcc70201e954168105aef9941
MD5 91a9075e588fa98392dc6c8db8b358ad
SHA1 8ffc741b2dddb568b8fd23e75ad729ee8f0409c1
SHA512 00c1d015129b3bf0b1392aa3e9b7dab4807854015dc49abeeef4f6e8c60f96d27b7a97de81e3995f3a2424cdbe9ebf47294ce51d4e88b9ea303e5f0f5cc0a8f3
SSDEEP 6144:MfmxuiwEa9wz4ZoeETEW1gbpJA3KpSL0pDVsEeYbgqK:Mfmxuiwl9ULePJA3KY0pxsBqK
TLSH
T14F944A43B7D5047AE5BE853844735615A73AB8224B72EBDF1A9404ED0E23BC2DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RealtekHDAudio.exe
- Size 402KB
- SHA256 36e919a8ce2d4a449369cfcb66ae8da0b5054c9fcc70201e954168105aef9941
- MD5 91a9075e588fa98392dc6c8db8b358ad
- SHA1 8ffc741b2dddb568b8fd23e75ad729ee8f0409c1
- SHA512 00c1d015129b3bf0b1392aa3e9b7dab4807854015dc49abeeef4f6e8c60f96d27b7a97de81e3995f3a2424cdbe9ebf47294ce51d4e88b9ea303e5f0f5cc0a8f3
- SSDEEP 6144:MfmxuiwEa9wz4ZoeETEW1gbpJA3KpSL0pDVsEeYbgqK:Mfmxuiwl9ULePJA3KY0pxsBqK
- TLSH
  T14F944A43B7D5047AE5BE853844735615A73AB8224B72EBDF1A9404ED0E23BC2DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2