Extracted

• • Target
    I6od2a5Fp8xYTzTH.exe
  • Size 714KB
  • SHA256 fa01cb60d81d40220dfd89c38d469a54cdac89e4dd9b6f978e4f7cc573c19c62
  • MD5 261f57f1d1b76dfda57202a05450a44f
  • SHA1 4afcc3057c53ea0f07e4d4a8a71d9e28678364d0
  • SHA512 03461bc0b8095a4db11480608be8bd6fbca3ebe6416c6d01d6abae293e85c0d7746b99cd0fd9e443f41afce5cd88175dff12af59d95c6478e83c38cd80329304
  • SSDEEP 12288:3CclEQhyEREpyFvM3iriwqf5dojE84ik:kQQmyy5MXwAIjvk
  • TLSH
    T159F490252FA4AD00E549143D897AE634D731ACE11602B34337CABE63BD0A9DDDE6C3D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2