Extracted

• • Target
    sixseven.exe
  • Size 588KB
  • SHA256 3505d51cd325cddd62a4e3ec312441f6fd0e37fe2442a435386bf108f70670bf
  • MD5 00ba9f855d7a7eb4038896a45715db6d
  • SHA1 c555cc518cb81013d2a73acd0fc418688cb4127a
  • SHA512 3917154f559f90b2ce5d67d75839312f07cf75df201751b644aa96034645a8b9c0b73a8ffb777ba20f117e0365f053782a69923c8fcb8581f562a067f474a3d3
  • SSDEEP 12288:BcTxGfHvhLv8YWhzkPVle8unfNfG77P5wWF+E:B/vV8YWhzPnfNfePp
  • TLSH
    T1DFD4D40CFE91E805CD1A3DB7CFEA11104B7165C1AF1192922169AFFE8B663B358E257C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_tcwjcmmwqyakvksheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2