Extracted

• • Target
    MegaLauncher.exe
  • Size 474KB
  • SHA256 3952f9401130303f422bb950587a2e4790177663660cbdad7ca75564c197a2ec
  • MD5 2ac21f0f632d168ac5ab1b74bb9929f0
  • SHA1 33e3718612bd722dcb74cde2d5b6ad170f562b17
  • SHA512 a4a33ecd819abbd2440dca28b93006c4c412407d4438f10196d5cd3c607123ff2f6ee0a47967f7f61b06be8a15a0e79f1f8a270ab4b2ef5aad800e3a7c8be5b3
  • SSDEEP 6144:pPU5p7vngDz4+h9enLdj8JQDDAZsF/HRiWRkBr3d09DC6rj2IpnmCf3X8wtbBszW:pU5p7vngD8MepADnBr3dU32Q0HCy0
  • TLSH
    T111A429257FA58E00D590247ECA7E3A09CB16E0F225026347370AF7A25D459EEDE2D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2