sheetrat | a4d1780a4de1fbd63a97220c5b98bf7f7c8ff8664c7456751543626b1a6e4091

General

Target
xeno.exe
Size 420KB
Sample260724-yahhna1fqa
SHA256 a4d1780a4de1fbd63a97220c5b98bf7f7c8ff8664c7456751543626b1a6e4091
MD5 e8799496095617dfbaeee900122c3851
SHA1 34f0d39c301977dd1c005e2955a9eb55941cd66c
SHA512 0a14db70dee5b1faf2c1e1ae1591878f1c058538a7a5750a808fb6f76e262fd32339449f4ce7532ec166d59b52b0c000d1b56f445f1e860f0184bf719b7f701e
SSDEEP 6144:7USbZatLKLP/EHC9wz4ZoeETEW1gbpJA3KpSL0pDROsXUbCGV:7LbZatLKLP8i9ULePJA3KY0p1XX6
TLSH
T152945A43B7D50479E5BE867988726614977AF8214B72EBDF168404ED0E32BC2DE34F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  xeno.exe
- Size 420KB
- SHA256 a4d1780a4de1fbd63a97220c5b98bf7f7c8ff8664c7456751543626b1a6e4091
- MD5 e8799496095617dfbaeee900122c3851
- SHA1 34f0d39c301977dd1c005e2955a9eb55941cd66c
- SHA512 0a14db70dee5b1faf2c1e1ae1591878f1c058538a7a5750a808fb6f76e262fd32339449f4ce7532ec166d59b52b0c000d1b56f445f1e860f0184bf719b7f701e
- SSDEEP 6144:7USbZatLKLP/EHC9wz4ZoeETEW1gbpJA3KpSL0pDROsXUbCGV:7LbZatLKLP8i9ULePJA3KY0p1XX6
- TLSH
  T152945A43B7D50479E5BE867988726614977AF8214B72EBDF168404ED0E32BC2DE34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery evasion execution sheetrat persistence privilege_escalation spyware stealer trojan adware ransomware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2