Extracted

• • Target
    fghjkfghjk.exe
  • Size 304KB
  • SHA256 a810aa99575ef229225fc67388adfac02e9074cac4ff7ecda97a9e567fd61c1c
  • MD5 8e22150ff878d6ed137e038f3415db23
  • SHA1 d7d4da9e6e74a5f9c818170e439eb6c0b0fbea3b
  • SHA512 f26a75830d1af24b90e5438ae3b9d14ab09633809c64fb03ba5f6d5c879dbf2fd300f19e6ed8f7d5abc3344520688fae3d55771d3041355e7adb0a49af037257
  • SSDEEP 6144:JrGPZ9nrBC/Le6VlWT8b95anBbMvXycO5xQ:JrKZ9rKPVle882vy/xQ
  • TLSH
    T19D64D40CFE91E805CE6E3D77CFE610008B7265C22E21928236596FFD8B5537699E61BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_rjknnhelcnbexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2