Extracted

• • Target
    https://s3.us-east-005.backblazeb2.com/vx-underground-main/Builders/LiberiumRat/Liberium%202.1/Liberium%202.1.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=005e2c099359ccf0000000004%2F20260720%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260720T014056Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=04e3f0afd25489771944fa8df8417c97299312f063b8f305006fc8c5dfeb83bf

  Score

  10^/10

  adwaredefense_evasiondiscoverysheetratpersistenceprivilege_escalationransomwarespywaretrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1