Extracted

• • Target
    Client.exe
  • Size 577KB
  • SHA256 a52ae34812b813d8632b3c028c540b52dbdbac0cc7507ca320356da0391b0ca4
  • MD5 a9f64efb678a853421bf38de6c7db3fa
  • SHA1 d882d5485f0cf1951ebbd74054efaffdc63894a4
  • SHA512 4cefe8c787f0f47e5312f41600d71fa39ca8fb33a8c6c0183df50c01f58e1fda0a077c9fd5eb1f493eecf93f75fee4f90ac3fd11fdd3b766694fa0cc6f6da890
  • SSDEEP 12288:FI2/nUBL6VOYPVle8wxUCzqX29HZ6rJsaXL:F816OvUC0MZ
  • TLSH
    T1DFC4910CFE91E805CE1E3DB7CFEA11004B7165C1AE1186562119AFFE8BA63B359E257C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_jopgvsyyoknuzvexecutionsheetratpersistenceprivilege_escalationtrojandiscovery

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2