Extracted

• • Target
    Client.exe
  • Size 681KB
  • SHA256 d14e7045dd4442929e94cc08e0060a1d478d14b34d3bbf429acafb8c529b3695
  • MD5 297f45de5afdd81b3cd5db0e8b6a80a4
  • SHA1 6d08f1544b16706bef4489ceb3e2cb994d62cab8
  • SHA512 e5c29e8cd76d60638ed815b61c25abaf133809505c53d5e30b322bc10e4e0c2d874d7dfafdbb4d6f5ed34f2c90fc1962c4a8feab330b62bdc44d7cdbdbbc0e52
  • SSDEEP 12288:9HpT3oRGVGH3IEiX/Gc9+0K9FhzZ4bfi:9GGAH3IPbK9blg
  • TLSH
    T1DDE4B30CBD51F815CE2E3DB3CBE690A11B7214C63E129116370B6FFA6B243A759A217D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_wvnkneyyxnexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1