Extracted

• • Target
    SSh_Client.exe
  • Size 552KB
  • SHA256 b55476f41ed05495b4b16cdfd490de1479ba8602cf7be3c4154b5542e1a6b657
  • MD5 3412aa719b85ee1f9b4e8fe9111dbf0b
  • SHA1 2dfcfa61fe349d126994b8ccfed4f55b53b36dab
  • SHA512 33302439ddd1424e42eac5cea3cde847d38e9cb989c383a8b675266de8ce7fcc3ebe544d9937e7bab9db28181272ce389492bb88e5125970ed1fb683cb030c1a
  • SSDEEP 6144:Nl53yZFOb9gM06DCdaae6VlWT8b9MBRzj8KuVXdlVrb6VlPBEuy0:NXLffDIPVle8+YVNVH0
  • TLSH
    T1DDC4D61CFE81E806CD1A3EB3CFE910049B7121C2AE2295563159AFFD87653B358E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2