General

  • Target
    Xeno-v1.3.60.zip
  • Size 6.9MB
  • Sample260820-gsa3vsfl2w
  • SHA256 8ecb968055c59dee679ef20ceff9a09eaa9ca10f23717c10fbe39d7d8a7b0a2b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • sheetrat

Version
  • 1.8

C2
  • neimdmhk.torgports.shop:22565

Mutex
Attributes
  • anti_virtual

    false

  • certificate

    fejnezt6j95d4z1cec

  • exclusion_wd

    true

  • hidden_file

    true

  • install

    true

  • install_watch_dog

    true

  • key

    azar24ows

  • path_client

    %Windows%\exploler

  • path_watch_dog

    %ProgramFiles%\exploler

  • pump

    false

  • rootkit

    c9urnkfci9p197lqqjuz0k

  • task_client

    ShellHost

  • use_install_admin

    true

  • user_init

    false

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat Payload 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • Xeno-v1.3.60.zip
    .zip 6.9MB
  • Xeno-v1.3.60/Microsoft.Web.WebView2.Core.dll
    .dll 557KB
  • Xeno-v1.3.60/Microsoft.Web.WebView2.WinForms.dll
    .dll 37KB
  • Xeno-v1.3.60/Microsoft.Web.WebView2.Wpf.dll
    .dll 50KB
  • Xeno-v1.3.60/Newtonsoft.Json.dll
    .dll 695KB
  • Xeno-v1.3.60/ReadMe.txt
    624B
  • Xeno-v1.3.60/WebView2Loader.dll
    .dll 161KB
  • Xeno-v1.3.60/Xeno.dll
    .dll 2.3MB
  • Xeno-v1.3.60/Xeno.exe
    .exe 188KB
  • Xeno-v1.3.60/Xeno.exp
    1KB
  • Xeno-v1.3.60/Xeno.lib
    2KB
  • Xeno-v1.3.60/XenoUI.deps.json
    2KB
  • Xeno-v1.3.60/XenoUI.dll
    .exe 145KB
  • Xeno-v1.3.60/XenoUI.pdb
    43KB
  • Xeno-v1.3.60/XenoUI.runtimeconfig.json
    516B
  • Xeno-v1.3.60/api-ms-win-crt-convert-l1-1-0.dll
    .dll 15KB
  • Xeno-v1.3.60/api-ms-win-crt-environment-l1-1-0.dll
    .dll 18KB
  • Xeno-v1.3.60/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 13KB
  • Xeno-v1.3.60/api-ms-win-crt-heap-l1-1-0.dll
    .dll 12KB
  • Xeno-v1.3.60/api-ms-win-crt-locale-l1-1-0.dll
    .dll 11KB
  • Xeno-v1.3.60/api-ms-win-crt-math-l1-1-0.dll
    .dll 20KB
  • Xeno-v1.3.60/api-ms-win-crt-runtime-l1-1-0.dll
    .dll 16KB
  • Xeno-v1.3.60/api-ms-win-crt-stdio-l1-1-0.dll
    .dll 17KB
  • Xeno-v1.3.60/api-ms-win-crt-string-l1-1-0.dll
    .dll 18KB
  • Xeno-v1.3.60/api-ms-win-crt-time-l1-1-0.dll
    .dll 13KB
  • Xeno-v1.3.60/api-ms-win-crt-utility-l1-1-0.dll
    .dll 18KB
  • Xeno-v1.3.60/concrt140.dll
    .dll 316KB
  • Xeno-v1.3.60/editor/index.html
    .html .js 164KB
  • Xeno-v1.3.60/editor/vs/base/worker/workerMain.js
    .js 133KB
  • Xeno-v1.3.60/editor/vs/basic-languages/lua/lua.js
    4KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.css
    294KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.js
    .js 2.1MB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.de.js
    46KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.es.js
    46KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.fr.js
    49KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.it.js
    48KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ja.js
    52KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.js
    38KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ko.js
    46KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ru.js
    75KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.zh-cn.js
    36KB
  • Xeno-v1.3.60/editor/vs/editor/editor.main.nls.zh-tw.js
    36KB
  • Xeno-v1.3.60/editor/vs/loader.js
    .js 29KB
  • Xeno-v1.3.60/libcrypto-3-x64.dll
    .dll 7.1MB
  • Xeno-v1.3.60/libcurl.dll
    .dll 637KB
  • Xeno-v1.3.60/libssl-3-x64.dll
    .dll 1.4MB
  • Xeno-v1.3.60/msvcp140.dll
    .dll 544KB
  • Xeno-v1.3.60/msvcp140_1.dll
    .dll 35KB
  • Xeno-v1.3.60/msvcrt.dll
    .dll 683KB
  • Xeno-v1.3.60/ucrtbase.dll
    .dll 1011KB
  • Xeno-v1.3.60/vcruntime140.dll
    .dll 121KB
  • Xeno-v1.3.60/vcruntime140_1.dll
    .dll 48KB
  • Xeno-v1.3.60/zlib1.dll
    .dll 88KB

Xeno-v1.3.60.zip

  • SHA256 8ecb968055c59dee679ef20ceff9a09eaa9ca10f23717c10fbe39d7d8a7b0a2b
  • MD5 SHA1 SHA512 SSDEEP TLSH