Extracted

• • Target
    cs2.exe
  • Size 49KB
  • SHA256 74ae47d31d4c69010a06aed3918ce84aca958350d95922dfba599682d2744c06
  • MD5 92e9148e0b1cf97e53a7bce4bd1c4ead
  • SHA1 c567b653ef2c0587b919209eb15f75c6bb3241b1
  • SHA512 4d70d5ada16aa5bce9b12c3a6c4b82ad28fd6c49008e70e4167d95c7ac43011ddf53db69a7f84597b5457b06e22c0f73957c032ff4c1ee0c8c8ba8dd0cb6ca45
  • SSDEEP 768:9FE0g/KK0kz8670DQnpt1QEEd7F90Xu0IMXB+nVf6HObdi+wV2V0kIlA7:DE0gKK0+70DQnpt1odgXA2ObU5Vc08
  • TLSH
    T14B333B04B3E58615D9BE52BDCB12B3089330C1575906F70B1EDAD0C62FAB3D49B8ADD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  gay12311costuradiscoveryexecutionsheetratpackerpersistencetrojanadwareransomwarespyware

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2