Overview

overview

10

Static

static

10

ld1atsww7fhfrsof.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ld1atsww7fhfrsof.exe
  • Size 189KB
  • Sample260714-ymwaaae18y
  • SHA256 7405f1149c615c1350aa6a1d4826eb854af5f179c2c375f5abf667f1f708dba8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratadwarepersistenceransomwarespywaretrojan

Malware Config

Extracted

Family

  • sheetrat

Attributes
  • anti_virtual

    false

  • certificate

    6pgn7zbs3gptam9biam

  • exclusion_wd

    w^&*r^&ewtoy99(r9456zo!)

  • hidden_file

    x%m^qla^y9l*6g2@z0^(u6k6+4o*uj

  • key

    i5jzv50k9goeeg9m7267mjo5a7

  • path_client

    nl*#yx9139

  • path_watch_dog

    @@m$d5b7vbm(#wxtsd!56y6ibt

  • pump

    %f%0@nisginpa5ndzd7a5g!3*+0h

  • rootkit

    XTZZmkQmX

  • task_client

    (lzl*r__i4xl7)b%tksu

  • task_watch_dog

    *_4hq)ft^q9evtl^wko5t

  • use_install_admin

    l4p^csi!v!

  • user_init

    c12y3!bcy_@l

Targets

    • Target
      ld1atsww7fhfrsof.exe
    • Size 189KB
    • SHA256 7405f1149c615c1350aa6a1d4826eb854af5f179c2c375f5abf667f1f708dba8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwaresheetratpersistenceransomwarespywaretrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks