Extracted

• • Target
    НИКСВАР КРЯК 2026/Client.exe
  • Size 580KB
  • SHA256 63ed04a6f8cebbef064a095835dea717c19ffb34da025a41efdbdba58f27a9cc
  • MD5 a8bc84168933d98a79bdb62c032f3fde
  • SHA1 a14702a39b00fd3607658a13f4b9271afcc10bee
  • SHA512 9863712a6069568be304fcc9ff85832589f809bcfe71546a3d44f7efd718719b4224be4cf3b6a3708e89f3ae491d7aa704dade56b8c129abc8335823feb08799
  • SSDEEP 6144:/U7djJqZiqIN2kQqnLCPDe6VlWT8b9kcTd5BEz0Ki9xsDRUnenz7Hbyy7AFOP:odDN2kQ6GPDPVle8CcbVxsF3nzN7l
  • TLSH
    T135C4B20DFE91E805DE1E3DB7CFEA20004B7165C1AE1196863109AFFE8B6537259E267C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_gqqyqlfbcdfwbufhcredential_accessdiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2