Extracted

• • Target
    PulseVisuals Loader.exe
  • Size 3.8MB
  • SHA256 38d509e046ab2a1d51b13278dbdeb68551a3c0cbcba4406261dbcbe1fa4f4e45
  • MD5 1df14925cfddf330a3afd8b5888c12b7
  • SHA1 a15a1c5437cfc52a1628c645c6290c72a60e0591
  • SHA512 ee662e54248c8b98d5ab413ed4c6eecf042661a3a9d80b197881a2c277d7f79933b7b3798ea2d2985f0367e645b9f84aba79513f8ab1d6d8ea526bf0eb4ab51b
  • SSDEEP 6144:9s+2K5uY7S8wrDWchClCYxZ5RqeAEA1c2HbYJKsFvydEHWNHXul5Tj/DU+6EUORS:dS8cDWHlWgZh48WlXWrD7ly+fnO
  • TLSH
    T1BB0612703622475FD65D06B8C488FBD4ADD48AF06CA0C75AFE3614BC4A59B805DFCEA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_iakdcrpqtlaqwvccosturadefense_evasiondiscoveryexecutionsheetratpackerpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2