Extracted

• • Target
    Client.exe
  • Size 603KB
  • SHA256 61e49b58e93247422cfa6e7ae6b16fffbe4ae4e8519b90abe549235a36f6244d
  • MD5 68a5e697c1d271051d8810025d7916d9
  • SHA1 90ad2ece1235f808fc19ea7888f615b7f51c2eda
  • SHA512 ecb8cc5ae25202ca073ca108318ee5d33bf28cd39f6b9c035fc4df35924ed6edd0576a7d953f5b638ac519059ffe40783a1e5c6ae2492e02b94ea7f871818dfa
  • SSDEEP 12288:YrJqSJbONYHCyuPVle8snOt+XR0wfgoivl:Y8SJbONGCybo2R0Uq
  • TLSH
    T15DD4B30CFE91F804DE1A3DB7CFE911105B7165C1AE1196423109AFFE8B663B289E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_tcwjcmmwqyakvkcollectiondefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2