Extracted

• • Target
    xenotest.exe
  • Size 439KB
  • SHA256 680e73b92861d2b426762f19b82a212f67195b4d8baa4e808c410a70f7a46f5f
  • MD5 e7d0a28469023035bc9e6491a3cd1624
  • SHA1 dcce693a7e0e2e59b02bda45228037837534e3cb
  • SHA512 a3d7d51bf35af44ca6ce9231c104f7d8b264d2e42d47a169a8291d620923c957bd05a89abaf5e13606d9b38983ff99aa44b16f5b0da2673943008a6fda124cac
  • SSDEEP 6144:XPGlfQcwf9voiNee0Tzt/juxGf1wwQnU2eKz+2RcR5iEeS3+QbzxXdhJo:fGlfQcehhMVuxGfzE3ZlEeS3zxZ
  • TLSH
    T1ACA43A197FA58E00D985253ECABE2A09C716E1F11502B3073706F6B11E459EEDE2D3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsheetratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2