Extracted

• • Target
    DeluxeLaunchеr-1.2.exe
  • Size 1.3MB
  • SHA256 cddd5e55137fa3c041b5c3471a2b4eb8754663bbbe59eb0a4061461498b6a507
  • MD5 0a5ca858cd51dea094ab07ee1f52f89b
  • SHA1 77bb95457bf275e9e8d9494aae1a05df451ba928
  • SHA512 400a5b3001dc85b5a270202959da420df8f4d1130a3af06bdced4ee78e55cc35846758f98ebf93468e2be1f4363719b89bd8104e8227bc5820f8f2decb80b675
  • SSDEEP 24576:DTL7ebCNRus5rKJUjCrvBOAbOu8ZLKqFJg1m1hzV904v:DviyDWU+rvBO/3pLHmm1f90
  • TLSH
    T1B05533865BE1442CE32DF6FEF9F6C89583779398B7802B5F0311A9583B039A1664CF46
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_jngytjlduuzxdefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2behavioral3behavioral4