Extracted

Extracted

• • Target
    SheetRat.zip
  • Size 50.7MB
  • SHA256 99a60fcac0dece3680705280cfaa44ddb264071ea8e86dabc71d28e6d34b91af
  • MD5 3a0038986a087debd946f704388d8055
  • SHA1 155c35498433654b4e0471b9cfc2a5aa2b98774a
  • SHA512 35832c7f4522efcdfce8426f837fd7aed677cef5d82024a30ccf464ce9049f37d9a545ee7ec1960f3961659e73ea77e16e42e4d902924bc1214a7ca008f0c272
  • SSDEEP 1572864:+uQK9WUvNqLjhJ+Npkew4L8ru5zUNsnJF1mh3bl:XvNqD+NpBwSRdQsz1mNl
  • TLSH
    T1B0C733AFD4540A4DF1A96434AC3899669D7BCBC10246CF7BB21F55C660386CB98738FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1