Extracted

• • Target
    Client.exe
  • Size 354KB
  • SHA256 d4d3351f74c728e673e3c1cab40bd3550a66c76423b790aca7860c62dbcd7a90
  • MD5 7e619b1975b4eb6803f032106391593c
  • SHA1 14d3f633bb1c54b5d55523515f2007568ee9402a
  • SHA512 b459850b125c7fe6dc7ea26eb8108ce4b7c99f56a922a92a2a4f4fac9146d2ad3541e78ee81679747504204f589673731c47fdf0cf8cf084cfbb5b625a29b1d8
  • SSDEEP 6144:mRxG6n7rXOC77MDB3COU2+ZZ7G1KAcyefG++b+nj2:mi0GUrjG0
  • TLSH
    T11B74A20CFE91F804DD1A3E77CFEA18105B7124C22F129256314A6FFD97693B658A26BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_mlqxvdlobvxqeusheetrattrojanexecutionpersistence

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2