Extracted

• • Target
    xbswai41kldg7wbi.exe
  • Size 503KB
  • SHA256 6c80412570c91ff41753c8b926ebd6bb95b10c4213318d0533e0d63bcd688b5f
  • MD5 897551516feaabbacc4068de2306cbca
  • SHA1 01bf914b11e4edb83f149f5ebfe9a46be5a21893
  • SHA512 ec40a5fd569a9d515ffd6d321a1eb1b1e899ee20e48f6c66af395fae906c81592b28abd602484b923ede92c65994b82827b9da12e05694e8c3b4cbf25b2d319f
  • SSDEEP 6144:RzC8DOg1FbDekAoaZERLHoR1G4p3trIZEtuqEsoXs3hm1fXlZq8os4sT+Yob6cU/:FpOgnDZKZEdoHxNIGt2q8ohUpZ
  • TLSH
    T161B419253FA88E00D484257ECABE3609CB16E4F225026347370AF7A25D459DEDE6D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1