Extracted

Extracted

• • Target
    5ee5b6be5c3c4cf65a1ab38ce3430a5253709f25829cc11e1b1906b634aa359f
  • Size 462KB
  • SHA256 5ee5b6be5c3c4cf65a1ab38ce3430a5253709f25829cc11e1b1906b634aa359f
  • MD5 428eb6d9a4ed23191aebd004e495440c
  • SHA1 23b4ab88dfa6c554ba918f1fa067be2fc47ff468
  • SHA512 784b862a479a7277553244b1669425f4b884d1abe3b92704b7d50954f5bca5ac9df702466b0746e33dae7a4e8e32acf4ede4fc29b75028634add2a40e3a3da4d
  • SSDEEP 12288:dWUovH4E8fkLIJkqNIjqWV7sOVldfcUJquK9a:dWUovLOqIJk8Ijds+OT9a
  • TLSH
    T19AA423630B879B18C6740FB10DE11DF6C8682596D06043D5AAC219BD8FE5B4FAC6FA36
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_jxexktatjcxiuckdefense_evasionexecutionsheetratxbinderloaderpersistenceprivilege_escalationspywaretrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2