Extracted

• • Target
    pampers.rar
  • Size 301KB
  • SHA256 303424c40ce507d6f8b0e234765606c3cd5ade6d502937d7f48f1d5c75f53fb0
  • MD5 a3bc4043bd8cd85e662f95ba5be00efb
  • SHA1 a723f332d839737528196d2038bfd7a93d423e06
  • SHA512 410ce58598319e31aab9a6b5500a998aa1af5b385548ec5a6d0ad7cc1e3832a042f2c4acab1d72a202206783f24c7544a25123ff6aaa24da40dbc8bb80fc35f2
  • SSDEEP 6144:hdFnmEg0DwkDS49b6alQJilyP8mdNA5dA8oVz6tA3HsR89aqijpsqCeM:PBx1wkDSO2DgjeiGaqesqCd
  • TLSH
    T1A064231E7D8B4CAF81077072BC701917AD3D85B14AB50623FE38C79A613E6ADC659863
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2