sheetrat | d40e0bdc29b1f16108f6651a3812c2f862682e6ae2ac097ba221751c433a34ad

General

Target
oo1neescdivyhajn.scr
Size 12.0MB
Sample260720-prl3qsat5j
SHA256 d40e0bdc29b1f16108f6651a3812c2f862682e6ae2ac097ba221751c433a34ad
MD5 1c6ea87dc12c888ebb142f4537117cc9
SHA1 1b3fa0d69ab84fe723c06f744b12edd7cc19e1f7
SHA512 31b4acce7163e555e049353e1db188618aa74ed66ce00e8ebf10468e78b55860215351abebf4f2bf486403d755f58cd3186755f7e1fc678339807d614c1c7ba9
SSDEEP 6144:gyAsPP9wz4ZoeETEW1gbpJA3KpSL0pD01fKb:gyAa9ULePJA3KY0pYt
TLSH
T1ECC65A43BBD100BAD5BE453844735618A77AF8218B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  oo1neescdivyhajn.scr
- Size 12.0MB
- SHA256 d40e0bdc29b1f16108f6651a3812c2f862682e6ae2ac097ba221751c433a34ad
- MD5 1c6ea87dc12c888ebb142f4537117cc9
- SHA1 1b3fa0d69ab84fe723c06f744b12edd7cc19e1f7
- SHA512 31b4acce7163e555e049353e1db188618aa74ed66ce00e8ebf10468e78b55860215351abebf4f2bf486403d755f58cd3186755f7e1fc678339807d614c1c7ba9
- SSDEEP 6144:gyAsPP9wz4ZoeETEW1gbpJA3KpSL0pD01fKb:gyAa9ULePJA3KY0pYt
- TLSH
  T1ECC65A43BBD100BAD5BE453844735618A77AF8218B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1