sheetrat | e01045fc1bfecf3957302fd8c1101ba6110b50c25ac51ba292f9d5c56f8f61f1

General

Target
NewLauncher-2.0.9-windows-x64.exe
Size 101.4MB
Sample260819-m4ajcssdre
SHA256 e01045fc1bfecf3957302fd8c1101ba6110b50c25ac51ba292f9d5c56f8f61f1
MD5 686b9b13d221d39a6596791a2533d8e0
SHA1 90261fa6177f46dd3765dc07d7c17ad9be8538c6
SHA512 fe79faa3caabe92b76128cd1b33134019b3cd0be797c47d23968dce058dc96a2cb012478b34555a694aa2f8baa855d604ddfd058dbd27f1b80017b7217bd5efe
SSDEEP 1572864:yioXDcXlP3kl1AAdth1BkVrTGWENSIjYKDc4ihI8dC7z06NWHFQ6ouv4:yijyHACFyGDPcKRihNQ8kuv
TLSH
T1623833F0C0A52C1B7654BBB36F3E8851E1E917EF2D06C32E67285778D1940CB47AA46B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NewLauncher-2.0.9-windows-x64.exe
- Size 101.4MB
- SHA256 e01045fc1bfecf3957302fd8c1101ba6110b50c25ac51ba292f9d5c56f8f61f1
- MD5 686b9b13d221d39a6596791a2533d8e0
- SHA1 90261fa6177f46dd3765dc07d7c17ad9be8538c6
- SHA512 fe79faa3caabe92b76128cd1b33134019b3cd0be797c47d23968dce058dc96a2cb012478b34555a694aa2f8baa855d604ddfd058dbd27f1b80017b7217bd5efe
- SSDEEP 1572864:yioXDcXlP3kl1AAdth1BkVrTGWENSIjYKDc4ihI8dC7z06NWHFQ6ouv4:yijyHACFyGDPcKRihNQ8kuv
- TLSH
  T1623833F0C0A52C1B7654BBB36F3E8851E1E917EF2D06C32E67285778D1940CB47AA46B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit sheetrat persistence privilege_escalation ransomware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2