Extracted

• • Target
    sstp5vizboq0ojmi.exe
  • Size 192KB
  • SHA256 015b875a64645116519a327531e2e0ca7650340c877064631b5e32cd3f66c78b
  • MD5 3b9a7ec89da0fad07fdfbeb9fa7250cf
  • SHA1 162c8bc408e1b6eb911651707c3038b5f83886a0
  • SHA512 7b92579e4878b11071234ece223c48be22dc2630b1560d1059bb11f8fe1c16aad0fec0ecb06b0b9f421e5dfd7ffe15ec77a30fb4d1120ddbdffc0150151abacf
  • SSDEEP 3072:43kp3uA1EDbn5BAaofT8H4nyDHoPppdECkx9RU5fi8qE/bwWkHT7l:pIAqDVyaNH4mHoPfZQcbWH
  • TLSH
    T12914F16D33D40D59D6AF07FF706A6317B334D2D3A943E7C9A69721E8F5813928A0207A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2