sheetrat | mode[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mode.exe
Size 198KB
Sample260715-x2vrmacz4q
SHA256 63addf7139a123bf8ff6369feaee8ccfa7388ea972f34e7b0759855bf0125b07
MD5 20f40951d7740d30bba98660de2baa27
SHA1 eb2cab0cd95dc8484f8b3e2fc7a97c9baedec35a
SHA512 1b1350e17e8bf9b66da04a1692bfbde8d815ff1336e8a8404c6f8fd4b67ddadb91a28fca7be200e585d782528586f3826e6ded0227abb1aa8cc7eb7381f00912
SSDEEP 6144:gN6kSYR7vEaOzJmSXpuXyhCJQ1UBx9wArUGH0dbWwlD:mH7voz0SXpuXqCBIOH0plD
TLSH
T1D314F1887B488A60E0BE46BA87A773509730C6536941CB1B2ECF90CA1F777D18D56CE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Attributes

anti_virtual
false
certificate
32tacrctokg7i0idc1m7xwgd
exclusion_wd
true
hidden_file
true
key
pvwf1v
path_client
%ProgramFiles%\xdwdSearch.exe
path_watch_dog
%Windows%\xdwdSearcher.exe
pump
false
rootkit
7z3ytizhq0zntyo4uhaxktuckyv20
task_client
ShellHost
task_watch_dog
CookieManager
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v1

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
mode.exe

File Explorer

mode.exe

.exe 198KB

mode.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 63addf7139a123bf8ff6369feaee8ccfa7388ea972f34e7b0759855bf0125b07
MD5 20f40951d7740d30bba98660de2baa27
SHA1 eb2cab0cd95dc8484f8b3e2fc7a97c9baedec35a
SHA512 1b1350e17e8bf9b66da04a1692bfbde8d815ff1336e8a8404c6f8fd4b67ddadb91a28fca7be200e585d782528586f3826e6ded0227abb1aa8cc7eb7381f00912
SSDEEP 6144:gN6kSYR7vEaOzJmSXpuXyhCJQ1UBx9wArUGH0dbWwlD:mH7voz0SXpuXqCBIOH0plD
TLSH
T1D314F1887B488A60E0BE46BA87A773509730C6536941CB1B2ECF90CA1F777D18D56CE6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a5:07:a0:00:b4:84:b2:14:23:55:37:ea:3d:84:cd:b3:35:72:6c:95:e8:00:76:8b:50:a9:b2:b1:93:d3:9f:83

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

Chains

Oct 26, 2022

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH

Serial Number

d1:d9:b4:e7:4c:7f:5f:41:d5:d9:60:fd:a6:f9:22:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2022 - Oct 12, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

198014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mode.exe

PE Signature issue

mscoree

dotnet