Extracted

• • Target
    Client.exe
  • Size 390KB
  • SHA256 82a85f38004f19cd46f7faec957c715af4041c75e167c9a181c5d24526746109
  • MD5 d36604e973ce1e5aaa0742ea9254a12e
  • SHA1 35a8cc8218d12e5d72f01165ef564a8b4b2d5981
  • SHA512 ab47a95f36380d52a6fe49fd9d448a2d20c5b6382733e0cedfa089b054116473da1097431d43380285d68aa7cbeaa246438aded56215f86213aaf4076e6dffab
  • SSDEEP 6144:R/YiYR3PYwiSjFMl5OBe6VlWT8b9XUWdZdb2UDo74by9WJ:189YEzPVle8dxdZtmve
  • TLSH
    T10E84C30CFE91F805DE1E3D77CBE610004B7126D12E229256314AAFFD8B653B658E66BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_duqqpvfulaexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2