Extracted

• • Target
    brabus.exe
  • Size 354KB
  • SHA256 c6694c1a76fa191ff75af8a391961ef51c023cdb672173836bb579a6db36526e
  • MD5 d6677bcf68ce431e572140de44c61b73
  • SHA1 f8b3fb666f1955df14c205f81ac81de18de447a2
  • SHA512 0be82f17cf0d9362542f8bb8c3f2840011be55d028ceb4de268e211e0c3a84c350776c33e4fd50941a85f62990191c820f5db6a1c4ae28aa8d93ddadd65e070b
  • SSDEEP 6144:1PpsHzYDAJa130l4lywxQLaZcK2nBggxNjDVbFWh3UeN:1o6sKaggxxni3UeN
  • TLSH
    T16074920CFE91F805DE1A3EB7CAE618105B7120C22F119256315AAFFD875A37758E26BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_mlqxvdlobvxqeuexecutionsheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2