Extracted

• • Target
    anter.v2.exe
  • Size 581.2MB
  • SHA256 d3818defc0ba6c26cb7ba872ee2f798ecf28aaaff479552b6786dc3e5c338fff
  • MD5 13df5f30294013367de8547e6baa0048
  • SHA1 f9843b92851ff078be09c929a533bd9654830596
  • SHA512 429159dc6ac8353d2e5d59bda96c1250d3c743fb9749f49462fd99fd6992d6dbde4d045342f766a2c09b166cd1563fc92ed2f9c86bb098e969b4d5698d50caf8
  • SSDEEP 3072:T9GgMUDl6f/mEy7c6dtWw1Ue4FCztx8XfYueyiUwwRF3Gf4gBObodb:TM6QfaxhyFCzH2AuRiUHQQb
  • TLSH
    T14959F104BF8CA671D7AD02F86B66551C837BA3136306E60E2CE754E61931BD8EB41CED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  mclientexecutionsheetratpersistenceprivilege_escalationtrojanadwaredefense_evasionransomwarespyware

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2