Extracted

• • Target
    ikads.exe
  • Size 198KB
  • SHA256 561e606075641e0c40666e28810c540b7102923b9aebb4622ab120d137c491fb
  • MD5 edf729ba574352c3d3aa97571b503452
  • SHA1 2bc253b0b1f7c8e321dbfa5590d2c4b672c2acd6
  • SHA512 9add624056cb6e3cf01b5820fdd86993958440c42e73644d37051b00b233c8e4c9be521a1e81b54687bfe1298d8de13d09ffe3a73b388bb0bc1ac5dfde6626b0
  • SSDEEP 6144:Sr3BkBVXi+iGoqclpBw5zcTohOC91xbEg:TXi+iqgpBw5DOuyg
  • TLSH
    T1A914F1587790AEB3C8BE9BB996A6B701D374D3030845D70B2ECAC0D16E833C5C95ADD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  userdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojandefense_evasionspywarestealer

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2