Extracted

• • Target
    ewgsdgsdg.exe
  • Size 459KB
  • SHA256 bddb8ed2ac05b2526b165b0439241b7ffdcf95c5950c189c651c5cea4d9e57ef
  • MD5 c0130095f757183d735f74e133b301d4
  • SHA1 5494f34eecb9a1d6155074a167aa445b9e6e6fe5
  • SHA512 de5fa0268f38773dc6f32409ac5ba0b9631adbd042e95a1a9d9f5d7edf45b95c249688974075f09a8020cea3b3543c9fc671258625c5c76cc5e4bb3712057de5
  • SSDEEP 6144:OE8Z+QdnATkXDAkJKWRgMVmX8+Pptz1DBTwdDVXnOVxrswa9j5fkMyf4i5Jh05bn:7S+QBikX8wn0ZptbMW02n/SZ
  • TLSH
    T149A419253F988E40D594287ECA7E3605CB16E0F125026347370AF7A69D099DEEE2D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsheetratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2