Extracted

• • Target
    NursultanCrack.exe
  • Size 360KB
  • SHA256 31d54f8ca8b8f38857b719f97ad4e88218256bcf2690b3ae876196a4366abf57
  • MD5 35e7f4289f5856d4265ec67987f8d30d
  • SHA1 dd053a9b191b448d1db8bd3722a902c86b0f02d3
  • SHA512 b1b0546b94c5597df63a2c945863410616040cbbcea358c57d6194736eb6066719190b69da960188395d1fd88017235d29efc3b6f56ade95ab8d90f0329f1b1c
  • SSDEEP 6144:u52Ewp4YM3bxNF3r209EdRh+7lb8qFjG5ccRFRwWaXv6:A2EfY6J34dRWiqjCtnG
  • TLSH
    T1BA74811CBE51E8C4CE692FF38BE65061577315C63EE2E253364A6EF8C7443A649A207C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_tzxpxvuvnkfviwjgexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2