sheetrat | 10a3cc762b91e91b724e4a6a9cf5f3ae3bac10363597e131c20da33fe373b8f9

General

Target
123.exe
Size 12.0MB
Sample260813-2edbaagq2s
SHA256 10a3cc762b91e91b724e4a6a9cf5f3ae3bac10363597e131c20da33fe373b8f9
MD5 3db163be845388d9cfc9d80a6e07d611
SHA1 868b0dd2c9485286996d1fc85b632b1b5947c288
SHA512 2db29ba1f3d49d4f02a6be2d629182a8fc1f14970e789cea7b141573c76ce9e1fc21cada57db4b9ab14ab213d0f1709c39a5a70cc8541293fc791dacd49af047
SSDEEP 393216:Vbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
TLSH
T1D4C6D02438EF90E6CA71CABFE5D1DFB23631985049F48C26B1BC045FAD6BAD23592135
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  123.exe
- Size 12.0MB
- SHA256 10a3cc762b91e91b724e4a6a9cf5f3ae3bac10363597e131c20da33fe373b8f9
- MD5 3db163be845388d9cfc9d80a6e07d611
- SHA1 868b0dd2c9485286996d1fc85b632b1b5947c288
- SHA512 2db29ba1f3d49d4f02a6be2d629182a8fc1f14970e789cea7b141573c76ce9e1fc21cada57db4b9ab14ab213d0f1709c39a5a70cc8541293fc791dacd49af047
- SSDEEP 393216:Vbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
- TLSH
  T1D4C6D02438EF90E6CA71CABFE5D1DFB23631985049F48C26B1BC045FAD6BAD23592135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery evasion execution sheetrat persistence privilege_escalation spyware stealer trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2