sheetrat | 083b196995bbb69314e32168f13460d5d4eb8b9ad000fe3f61082fcefaf6a1cf

Sharing

Copy URL Twitter E-mail

General

Target
Sheet rat v2.6.7z
Size 28.8MB
Sample260810-jprmjsyvbw
SHA256 083b196995bbb69314e32168f13460d5d4eb8b9ad000fe3f61082fcefaf6a1cf
MD5 f67d6014df95e47d28741634b913bbdb
SHA1 804844031cf8672e77748c91cff7262df45c025a
SHA512 31b4cfe198586b6ca1c746e7a67379b153bcf2dc38424b6ea9957fdb82cb326ff40d56436bb2fe0579e469c42dfc00ff27700b4c4037d9d3ff6b45e86fd039fd
SSDEEP 786432:Kn0yV9SATGf0QY8Qua5MYkDMdb2eoae5dm/Kr4SV5NdTjo1:Kn0yXS9838Qua5uqneuKr4S9Q
TLSH
T1936733E025725572B9E0AB75453A1F8702BF8D973FB395B7D1393132827EA9370C1A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Sheet rat v2.6.7z
- Size 28.8MB
- SHA256 083b196995bbb69314e32168f13460d5d4eb8b9ad000fe3f61082fcefaf6a1cf
- MD5 f67d6014df95e47d28741634b913bbdb
- SHA1 804844031cf8672e77748c91cff7262df45c025a
- SHA512 31b4cfe198586b6ca1c746e7a67379b153bcf2dc38424b6ea9957fdb82cb326ff40d56436bb2fe0579e469c42dfc00ff27700b4c4037d9d3ff6b45e86fd039fd
- SSDEEP 786432:Kn0yV9SATGf0QY8Qua5MYkDMdb2eoae5dm/Kr4SV5NdTjo1:Kn0yXS9838Qua5uqneuKr4S9Q
- TLSH
  T1936733E025725572B9E0AB75453A1F8702BF8D973FB395B7D1393132827EA9370C1A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  sheet rat v2.6/Plugins/Shell.dll
- Size 11KB
- SHA256 814ff32263b24e91ad6a8d00e6a9fce3e79bee939d76824d8727b04d772b4fa3
- MD5 3d2ba275ab2effe84b2133e454369d8d
- SHA1 459409c58abb1a9a3dfa982e4936b5cc0113f701
- SHA512 46fb7675a51df8b15c0460ba2d774d83b9630caa1fbc7cbab417ab4a966cbf30e9e64f3ee6e2e65cb1650d1cf431a2682b4f680256d8c3598b845cbeaf062977
- SSDEEP 192:oh87KIwOQSOsO/BC7hY1VxyZZTXoJc8aDPf/1BdTjtZD/ym:N7KDOROsO/BC7EVxpEPftBJjtZD/h
- TLSH
  T118320911ABF4C67FC9BD453618B3871042B4A3866907CF8F5CD460DA6F2ABC997227C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  sheet rat v2.6/Plugins/SpeakBot.dll
- Size 9KB
- SHA256 f5cf80fdd20004e3a9613cb4bdfcfc388f84c8f94db88698da68ba450ff2b2c7
- MD5 8ecf481177682ecb8902dd85f7dcc607
- SHA1 0575c5068aabab48ab3b5895128cd95743dbd5da
- SHA512 472d0a67fea7411deb9ebb486495d92a7aa1c45fbc3fe05e7ac65b6d8f2839e2b34eb02ab55135726f3d0ae1942ba77f2e0bd9264b7bee0e3610d122aafe4d9a
- SSDEEP 192:aiSrKIwOQTOsOXLhLYN9NPMUsCdeCeCkoE7g9yrR:a9rKDO4OsOXLhLejRscePCkoEU9qR
- TLSH
  T1CB12E71ABBA1C33BEEBD4A3648B247A14771D786660BEF5F0C54A09A1E163C907217D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  sheet rat v2.6/Plugins/Stealer.dll
- Size 588KB
- SHA256 3bde5b1c709aee5e9f37da56e69311a4f90bb49b1d48f63837d9d2cb61c8d998
- MD5 4f4396fa54d391387278e7a01bf86b90
- SHA1 6b802ae39bc0b0124b5a728e1d8d82979d09dd85
- SHA512 e24f55ffe8e0f34450f7e2b84cc7e8df727282cd1153a720856c3d480ca4b165089d3134580a3f0e6f4b0a08bd358c0fba6a2203404ced1efdc23b8db9c5bf2e
- SSDEEP 6144:+hNTVz1OnnEZMnqLP4LXZbaKD0jyGtSV41QJDsTDDtUMle6ZjxLV/293truyeI3O:+hBVz0nEFpS4YsVUCe65f29d1gt
- TLSH
  T1A6D48D002FD5CA5BF1FF27B2C0F342949775F826B93AD78E198420ED2A1274499167BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  sheet rat v2.6/Plugins/System.dll
- Size 9KB
- SHA256 b16a3300b9e6fc91952aabdaae1e23988af9d11d47a219c943b24f9c34a96c5e
- MD5 c2385c1f53830a5460c1860a45d87d80
- SHA1 f17bfa6627fc74a25f3d1f820487e4186fe58d6a
- SHA512 4345833f6976f5e8c0a60e436e0a31c5a2778a7987eabf4da0d7319758c0ea3e258306573207b8101edd8f6c5a02b9104fe5d81bc6a101d161f8f3ec9000af15
- SSDEEP 192:4z1pmwOQ1OsOP5409hCZJYQvlwbGG9JAwZ29PL+:4JpFOmOsOP5p9hC/YQlwbN9JAGIPi
- TLSH
  T1E2120801AB74C2B7ED7D073658B7834147B1E342A907DB5B1DA8509B1E2B3CA5732BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  sheet rat v2.6/Plugins/SystemDisable.dll
- Size 13KB
- SHA256 5166d3458c98962a5c49786185d26600563b6ca3afef2c9e35079c7dd4b865c3
- MD5 416fb9285fe6e40959e3e2a9f4d87919
- SHA1 3ac1683244a009d8ccd43c5d136a7acd64203bc3
- SHA512 cf325b560d55c396cfaf25b005eb481db3acef4fed53729795c094faf238234474c2fd9bd9e45978b504bd1c881fb346781a606e90a2e102014b79adf8815010
- SSDEEP 384:XBFOkOsOsrNcwfu+nnROzb/92/n9euEFdj:XLTfuonRsbFYYDPj
- TLSH
  T1DD52D801BBF8866AF1BB4F31BEB66724CA37BD0AAD12CD1F0855104D49327C48921FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  sheet rat v2.6/Plugins/TaskMgr.dll
- Size 12KB
- SHA256 79c00793de5d62302c16d60f00dd21f864748de4ae17b2cb6cd4eeaab87fe9a4
- MD5 c49afe7c8af97fce442ef4e0dd796b7e
- SHA1 18234fb90c4676fc1a493fdef87168bce8775cc4
- SHA512 b36307eb3c2615cda99fdd594fb1c119df2ab59a87a2f4c34878ed640c47118439d02ccd0f43e9051dd188cd2fb9c3dc4952a13a9832ee129ea0fb2e6f880274
- SSDEEP 384:g1S/gg9WsoROf37h6JZ3mx2RJtGox/xyx7DwLo1jDl:g1YWvRODwbbRDfo1jDl
- TLSH
  T17A423B0AA3A4067BD8BE497B74B3C3A403B5A7426A17DF6F4DC860D60F163D61B107D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  sheet rat v2.6/Plugins/Uac.dll
- Size 19KB
- SHA256 fec5ce9214e638a7b337177d4c9ac927734872e5198a7e7201a0ce6273cfa77b
- MD5 53bd2ce77bfb21d22bc831285d64a1ee
- SHA1 573b8beb4766374531eb373dd48ddde45f14e0d0
- SHA512 09bcb81d6a72d9ecb392f3fcbadddbdea8966e14cd6c64fa6011020dc48a84bbd8ee69a593dabf12e9711e09908edfde09581210a4501317bd107951eaa929ba
- SSDEEP 384:MzfirHbjkh0X8xNbGXO6+uqMi38wAAkYGbHFtslaDu1qQpX:cfqHG0kNbw+ei38+qSX
- TLSH
  T15C92F786BBDC5971E6BF4F796CF212010272BA160C27DB4F098540D91E7AAC497B0FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  sheet rat v2.6/Plugins/WormJoiner.dll
- Size 1.4MB
- SHA256 83bf7e0729f78c1c38bb77025843d4b680103aa70c4a84f19041efff8c88c7cd
- MD5 47cd65eeacbf54f87f2aa9cc16c6e31c
- SHA1 eac36baa52bf5ee9a844732c1b84e1557a72c12d
- SHA512 b7a50627a50df81fa283cdec14b30576179d867a57fb9fdee42adf1740ab598f07a6424f795f34f457e82ddce8af74339fb88657b9a4761465cee4fcc86c67de
- SSDEEP 24576:MWLnVIj2bA+2Utr402pr7tdSWlufOkAQcyNkP1Q:MUVIj2Ftr
- TLSH
  T1DE655C01FFE4C62BE29F9777E57202641BF1D406A353F74B462896BA5C433406E863AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  sheet rat v2.6/Plugins/WormSMB.dll
- Size 458KB
- SHA256 fe347d754bad7d8e7a9b446d94b965b43e987819af6afe6160d4dc73ea3b5b1c
- MD5 1a74d3d32675790e76281df64148383c
- SHA1 1191e52832f8a93e5bd814d147b9c70986c6af6d
- SHA512 e53b4bf6c8343b432ade5776971b9c79f6bf9393b11e692e9e6f7938416e97c7c78f40babd336f28481d59107f0cad8748dbfbaef5bd91d142450e8c07db3592
- SSDEEP 3072:b6m1g0sbmkuNoLXyh9KfocUh15BHrbdfOXu4yQ0SUTGTTrhqfldNeh6x3RMuSCgf:bv/dGESUTGTTr4fldNNhtJKLXBa8rWm
- TLSH
  T10EA42BF46BEB2966F1BECF76AD7315808C2D7C366F06C16C40B103590835BDA996E623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  sheet rat v2.6/Server.exe
- Size 1.3MB
- SHA256 ce8fd5ec0b2ee4e5d87d35622eeaa022ee971801c97bcb3726ca6ebe4b576238
- MD5 dd6667db55acaefa2d7e99dcf5d97a26
- SHA1 c1b281ef573df4da584294c61b5322edfed589ad
- SHA512 916c8b63400c0a8e495fc59d8e348499a6f04421e79599803c7ac4cd828c82f389bfd733471de27cc1643c03723429f8544446d9adc69082e6a5032139a1f1f1
- SSDEEP 24576:RIVMEFyWLoQJV+fLmomlEkmmsEnE7E7E7EUmemmmmmmIDmeIjwnaKk:RWMEMWlVILmomSkmmtEQQQUmemmmmmm7
- TLSH
  T11C55594237B41D2CE17F57F1943602A483B26A03D4ADD7AE5CB5709DE9E17E0EE82293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral21 behavioral22
- Target
  sheet rat v2.6/Server.exe.config
- Size 7KB
- SHA256 28026de2c65972cb8fac1ff2865c33e24d1086f7242b2fe951cef172909ad128
- MD5 2083876ec03ad06e5c16490fcb4ab8b6
- SHA1 b8f50f08abd53225c046912471dfd271a98cf15a
- SHA512 b16f1fbe8e10b66079d83a46818423fb2e2e8619cbdc1427ce0cd27f06092af52bcc003755e939320cf84f8cc5a26c92e43041013fe3ef60c7d73d8624ee6096
- SSDEEP 96:ur71Qz7KR7KprDRnbWCPAnnAnBbAnGAnXjzAn+AnYAnTAn/AntWAn+yAnbAnNAnc:ur7o747orDd5P
- TLSH
  T1ABE1310CB1C19F9A15366631E73052D1EDA006231276B0F0B8ED31676F70DDA5AB37BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery spyware
- Drops desktop.ini file(s)
behavioral23 behavioral24
- Target
  sheet rat v2.6/Stub/Client.exe
- Size 47KB
- SHA256 71824238c3baec179911bd6e4655ebff234e15d0f14248077e2c388ef4337009
- MD5 a0e04bf9b43f0b442bd3193f06dc52b5
- SHA1 30bb0c17640c414d948ed3e2fdf571b98f125efb
- SHA512 d7015f5c8223ba0f4e3b478185fa3e4de0831aee949302185fdc8b3afe59105fe096a3e5ee23219a1c16dfcbc77d169a82774ecd727ef98bdb94a878583a2ae2
- SSDEEP 768:+nqRz+Q9CF6abcLPbUG9bOplP7ZXdEEyb:B9g6asD79bOHLDu
- TLSH
  T151232904F3E84519D2FE56B858A291C8827DF5DFA612C7DE0CCA90E91E1E7D48A01FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

sheetrat trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
behavioral25 behavioral26
- Target
  sheet rat v2.6/Stub/UserMode.obf.dll
- Size 136KB
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH
  T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  sheet rat v2.6/Stub/WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH
  T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  sheet rat v2.6/Stub/ddb64.dll
- Size 32.2MB
- SHA256 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44
- MD5 82967b6c24f52664a3b9399f853ea812
- SHA1 064e83897c545f71f2f6a879ea0845f6d23ec9b9
- SHA512 69625de4e8cadfd361858cd588ef514cf8cac5f1a022541f831ff490bcc5048bb580f1c2a04820f3f978c299cf7b24058c9173cb51086e8bc4813432012e697f
- SSDEEP 196608:LEYDJk52U0CDn/DM4b5chY56H5dg5Ej9bUYvqNE6/+XBpSOXtOkO+O:jDcDn/DM4b5wY525dMy
- TLSH
  T1BC775CD97AA9754BC048157CA18BAFB4CC9E3623003F8ED42CD09DEB5E55EEDF412298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Drops desktop.ini file(s)

Detects Sheetrat Payload

Family: Sheetrat, NonEuclid rat

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32