Extracted

• • Target
    Client.exe
  • Size 370KB
  • SHA256 b5973f76e6b4f674e387b0b60cc33a23ff873b4cffb5c065b8f035418c163cd1
  • MD5 d67370c29fd494a7b41a31b4ff440d2a
  • SHA1 67fed522d8eab429199092404e703f5ffd917a6f
  • SHA512 dea584b172a7c315f0c6c9a947ea0bfbc8fd6fb6976402ba52001cea2c554ad5c8f5b2dc2b449c68f93c892aeafc65c68afae04e6cddc1e0d72725468a599e1b
  • SSDEEP 6144:f6ZOYT/B4B6luHnervxtfe6VlWT8b9oE7u3EYbMgK2ofjgB1:ikYT/S/2xPVle8aCUYSB1
  • TLSH
    T1D784C20CFE91F805CD1E3E77CBE610044B7125C12E2292963259AFFC8B9A37658E65BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_jxhqrvwptjlhwgodiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1