sheetrat | ygx97khbpkwsdwul[.]exe

General

Target
ygx97khbpkwsdwul.exe
Size 45KB
Sample260811-e4hkza1xcv
SHA256 c27d346a1fb099b1cedd84556dc48825966fa5fedc1c9c56b6a125c6f3a91075
MD5 a594d071cd3dce384d23e75105066036
SHA1 415d821eab8820458b6161eef037f6329075db1a
SHA512 a2b821844d94490d3911afc921e8b652298517e768ce4f71518ed61e159fbf14c2ec04857e14bf9fc32692e8e9227d22e24ae162ba3ac55f89c16b7ae72df5d8
SSDEEP 768:iK6oLTj3a21xEHUEgSd+fU5mkR2ObyCmwPg1ijX1oF911wZYBxkD:iKPzEHOc+fU5QOblxPggjX1oF9bwax8
TLSH
T168233A4433A88921E69F4AFE531BA38A5230C3735402DB4F7DDB5DE12582BD99B02EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

user trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Version

1.8

Campaign

user

C2

viovii-35455.portmap.host:35455

Mutex

Attributes

anti_virtual
false
certificate
lkkv5xs23fpzce
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
04twj1
path_client
%Cookies%\CookieManager.exe
path_watch_dog
%Windows%\cmd.exe
pump
false
rootkit
false
task_client
MicrosoftEdgeUpdateTaskMachineRU
task_watch_dog
MicrosoftEdgeUpdateTaskMachineEN
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v1

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ygx97khbpkwsdwul.exe

File Explorer

ygx97khbpkwsdwul.exe

.exe 45KB

ygx97khbpkwsdwul.exe

SHA256 c27d346a1fb099b1cedd84556dc48825966fa5fedc1c9c56b6a125c6f3a91075
MD5 a594d071cd3dce384d23e75105066036
SHA1 415d821eab8820458b6161eef037f6329075db1a
SHA512 a2b821844d94490d3911afc921e8b652298517e768ce4f71518ed61e159fbf14c2ec04857e14bf9fc32692e8e9227d22e24ae162ba3ac55f89c16b7ae72df5d8
SSDEEP 768:iK6oLTj3a21xEHUEgSd+fU5mkR2ObyCmwPg1ijX1oF911wZYBxkD:iKPzEHOc+fU5QOblxPggjX1oF9bwax8
TLSH
T168233A4433A88921E69F4AFE531BA38A5230C3735402DB4F7DDB5DE12582BD99B02EC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Resubmissions

Sharing