Extracted

• • Target
    https://mega.nz/file/vgwGgBTZ#1_YE5LCVh_GT_FbrwuLa3EdFs3ObJ3csGXkVTX8wg2s

  Score

  10^/10

  sheet_sfgoqgmolfiguazvdiscoveryexecutionsheetratpersistenceransomwarespywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1