Extracted

• • Target
    Client.exe
  • Size 682KB
  • SHA256 7db893465a9eb733345c61599f7d3da6234bea656c0d519e8b8eefb6b3621950
  • MD5 6a38e2a42f9650b4063d34a94d51b995
  • SHA1 3047e4d612047d59df677ad2da7987fed489638d
  • SHA512 87385a7c837a1d444905ec95137299bec7f6da5fdd98be2dbf4f605669bacf6c4db9b90053db88a9591fa74e903c9bcfa3e48ff601aa85f9ac0f87c33b4ae79f
  • SSDEEP 6144:S6gDk8LMH2ccb6dLsFX8C6ngDp3r209EZszcW/mg9vu6bFb6cy1afdOhjfURhB00:S6l8oLcC0XYIp3YLs2NK4EkwbFu5
  • TLSH
    T10BE4930CBD51FC05CE2E3DB3CBE2A0A11B3111C63E62952637076EFA9B543B659A217D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_wvnkneyyxnexecutionsheetratpersistenceprivilege_escalationransomwaretrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1