Extracted

• • Target
    New neverlose crack (fixed).exe
  • Size 751KB
  • SHA256 c913f13c6870a02b23b88999b5f28932a0c43eb1515763f555f43b94f80b6386
  • MD5 000ce86df2fdaf9fc6dfeb06c805002d
  • SHA1 8d0f1750b6d0b3916142c429e9ed719b7f4f1e33
  • SHA512 bf5ef0a37d5221b11836ebaf864680ba6539c3b96793bef2944ce55eb66956dfe723a7c26c1574045c2047c261f0bb85c5421296424b5a88ab7ef48acf766437
  • SSDEEP 12288:sXtBj63BuMM9XLhSqGhY4RW7VfTyHtpwIAGijIpl3:fBu9GvRW7Jc3MeN
  • TLSH
    T187F46F252FB49F30E74C193D857A2618D732A8B3160273473706F2A25D2A9DEDE2C7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2