Extracted

• • Target
    w5uexnu2lns3pa1y.exe
  • Size 488KB
  • SHA256 ada767407c8bc302b79404c4a6b4895c45b08a48c593472599cc2373cf445e96
  • MD5 21b6a6db075dcd0f36a02c064ea63bbe
  • SHA1 3056fa139cca9a3eedda3a3588ad8b79dc029086
  • SHA512 87a0dbf4846fe2913e32b4ecabbc536d84f6ecd646f8997925b415c798ec5ce69be956c69c4c3d843348c9a584e17db437c68e329e3af6e370fea564ad4544c6
  • SSDEEP 12288:7dAuKGVQ35/OZwI/wY6CHTyMobMvoPff:dKdI/weHTqbCaf
  • TLSH
    T120B419257FA48E00D580287ECA7E3A09CB16E0F225426347370AF7A25D459DEDE6D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2