Extracted

• • Target
    Sheet Rat 2.6.exe
  • Size 421KB
  • SHA256 b4c53a49cab03ef326068030f12e5be22625932bd4b526a62ff7d053bedf8283
  • MD5 bb3292ae0e8b7a25f6be35b33fd297ad
  • SHA1 16292b6ccc8938e955f2307c82ad1572fd681f6b
  • SHA512 d86a02069a4f655584724e1f5614682b7a66429b791e57442b09b351e5187b7f9558f1e5c21396ddaa910b490e3168ed8bf6a0d3cc943e2ea70969a28c1bff80
  • SSDEEP 6144:aLvZNuh4baGicpe6VlWT8b9e//H6YsYKKkrbFqbsMEQ6:anDBPVle88KKklqbsME
  • TLSH
    T1B394D40CFE92F805CE5A3D73CFE614104B7125C22E259296314AAFFC8B9637658E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_ofxkderoxtpcsheetrattrojanexecutionpersistenceprivilege_escalation

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2