Extracted

• • Target
    mkbqwxq1wgm730gn.exe
  • Size 2.0MB
  • SHA256 4e2f91939cd45540b0c37997c59f9a451b3db4dd2c940948bb37e134e49ca641
  • MD5 13f6ad2bed07b249f656261115c57d13
  • SHA1 b4b87cca01063343e48dbaa75213ea4f5d170146
  • SHA512 aae3f8b565718e593252ec91f1cd9226f3167eec6d7b9aa72f2470ebc0d43e7a8628c58b96cfc19a27894ffbf741b9ca206b81f4376781340fffc2d48f4a6028
  • SSDEEP 12288:Ipn6rkwMqVBBPNP03IxixyWJ8FNcVSYJ9qwdE+cKX:fX3BFAIYEQ8Y7r/cK
  • TLSH
    T17BA5083897918806D192367C0971D3B5E766AFC46112E327BBFBBCAF7E19197AC480D0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2