Extracted

• • Target
    Client.exe
  • Size 558KB
  • SHA256 3cbcd57932f4423eb93753cf1b97093d6856f16ae5a4af180048bb65fb696c84
  • MD5 5bcd48efe4c2f984936ab7416dfc7433
  • SHA1 6d3c1908417e774ea6688d90c0dc8674e450a4d2
  • SHA512 cfa3e03006c7062728ad569c96024683e1d9ea8a3d81e5d8327e5158655f2fdc2a067337ec17edab415672201888f33f50b55a3392e2db8bd8fdaaf4db172135
  • SSDEEP 6144:mi0LpNUM1VCZmtWLRgF/ETfF6wwupHYVr1e4kn1fARFQmc0plorRQ/FL0EbpUHp5:mBLpNJLWIETdfXOuyBoF97DOJE
  • TLSH
    T12FC4910CFE81F844DE1E3DB7CFE911044BB164C1AE2195922169AFFD8B6637259E227C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_tcwjcmmwqyakvkdefense_evasiondiscoveryexecutionsheetratpersistencetrojanadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2