Extracted

• • Target
    NursultanCrack1.1.exe
  • Size 11.2MB
  • SHA256 1e488696fa2371219636397c3891e64b3538b9b21e826c74aa1bff94fab1a400
  • MD5 9382a9c12bddd4d710f037b399d1c53b
  • SHA1 6836261da2b19c9f60ffb1b72d823ec1eeaab0df
  • SHA512 46ea20cf90af8f10911119dd671c0959a34b90ebeea1384487a38d2870b8031ca1818e4bc791f812f3d7700fc9360da6065682e08815c35e89b9890cddab8ff4
  • SSDEEP 196608:Oie+zx78AZDWnBH40lbdHCQfmgjuKNXbWXQQ07gcggbD8r6flk:9Hx7vZmBY05cemsdXS07gcH6
  • TLSH
    T1ADC633D7AC917CB8CC064271DA3F0509467987EDB7AFD0CE315936BEC2A669AC48B41C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  t.me/junk_codeexecutionsheetratpersistenceprivilege_escalationtrojandiscovery

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2