Extracted

• • Target
    DeluxclientcrackbyUnix.exe
  • Size 132.0MB
  • SHA256 a50f8418733ac7bbd0f4a7fa1b2b3b5cc1ccab71d054ba7123c4eacf57f7bf9b
  • MD5 8b0a9f55067ece7c4c6b9e86ad6e9833
  • SHA1 625e752769b9f790e87517e1ef8b5408a8d6767a
  • SHA512 d484c1ec930c1475f8a8e16307c88344b0f23bde28c81fe6b3054f02fb878353da46fbdb504a3930f60b1689902835fe389092ae36a0695f312de50af746c66d
  • SSDEEP 12288:YrJqSJbONYHCyuPVle8snOt+XR0wfgoivl:Y8SJbONGCybo2R0Uq
  • TLSH
    T1FA68B30CFE91F804DE1A3DB7CFE911105B7165C1AE1196423109AFFE8B663B289E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_tcwjcmmwqyakvkexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2