Extracted

• • Target
    sdhugyfsgduyfsg.exe
  • Size 568KB
  • SHA256 6f4614b298283c431c67b12c3d5eee38398c9266d82951ce82d55507bf5e7b10
  • MD5 2af4c285b6845c2ef37e018383512924
  • SHA1 a1d3640d07518c99fa85cc282f60789e7b449dd5
  • SHA512 12192ecf25a73f3c483f63bea5db79609c67078bbe8def901f1dcd362915966eec2e0c8f523adb33de639c4b46c1e17280c6d701de8891e8b67fd29e9a203687
  • SSDEEP 6144:OIcq2SR4c5eRZ68s9pTJFmhobd3a3w/X9XSZfSgSBB2en/P+5uNBwnNSeYkb9zHY:OC5GGYYNCtSf8enHbiNJxsJr
  • TLSH
    T186C4820CFD91F804CD2A3EB3CFEA18145B7121C1AE21964221596FFD8BA937259E767C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_mldmrgomptydiscoveryexecutionsheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2