Extracted

• • Target
    СatlavanLauncher-1.2.exe
  • Size 1.2MB
  • SHA256 8361adfd7eec498d46bf2f30e7882fbb4c00a4bcf342a30916895fa94cd03ba2
  • MD5 db5ed7934a4d7020983d0b4a550dbd3d
  • SHA1 d05575a28d106468e5abacaa6049e5de02a4ef57
  • SHA512 12cee080c6f637d8dccd574cdbace472c447e697941cdee48819e77b9a500fe415e0906a04bb4ac5a53429c332cef998562778724ae1c0ee6a91667e91cf2e7c
  • SSDEEP 24576:b3/wrsXnl9563eZkBHUp2PWKafqlgPvZU64lJ0OdzjAR:ASkB0p2PHls4k6zjA
  • TLSH
    T15A55338D8E55E83CDB2971B116A85F360E0C1AC6FE8BDB4E6D23975BC8166301D4323E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsheetratpersistenceprivilege_escalationransomwaretrojandiscovery

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2