Overview

overview

10

Static

static

10

o793zar6z2lxpbdf.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    o793zar6z2lxpbdf.exe
  • Size 189KB
  • Sample260714-ypf85sfs21
  • SHA256 8af502fe669e9c226ebbc60e33ee5f2e273b7e5c6d0030556bbeebdbb0acce8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trojansheetrat

Malware Config

Extracted

Family

  • sheetrat

Attributes
  • anti_virtual

    false

  • certificate

    wdi1t9g6h33ozkod5izzo9e

  • exclusion_wd

    p5ejp$fq+1c

  • hidden_file

    @2)oikr0w%tqlz(mpgg%

  • key

    4axoyg936mjpta

  • path_client

    qez7n&z1gb1&y%znd#g

  • path_watch_dog

    669gy$!6

  • pump

    l0%+p95q$jsbk7pu7%x0l@ci

  • rootkit

    ~uuh2.h

  • task_client

    #&g5(6v

  • task_watch_dog

    *_*%4@n4xy_r0a&ng9q1l

  • use_install_admin

    1ni_%3pj1!xh1rj^2#75!jdr7!%

  • user_init

    hb%mu23i$x2f#qy9&9@^

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • o793zar6z2lxpbdf.exe
    .exe 189KB

o793zar6z2lxpbdf.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 8af502fe669e9c226ebbc60e33ee5f2e273b7e5c6d0030556bbeebdbb0acce8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
198206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths