Extracted

• • Target
    Client (2).exe
  • Size 546KB
  • SHA256 189d716a18d2e6498cc009a9519f508bd0b300793932af7137b9aabf5ba585d3
  • MD5 1fc0f1acea4b3cc58dcd2061e2cf4251
  • SHA1 158eeeecf943374428ef4cf96172fa68145f99d9
  • SHA512 6f3f7711c383bb5dbaa99de7cced93ec1298c0cf6f7943f1691c01bb0b6072a57a5dc4ed5d89909077c12b1e91566c0d80c2cdd1922227964c74eb17175af135
  • SSDEEP 6144:7tDcSoUHnPY+mhduNsWNOe6VlWT8b9rUx9Wz5Iy/y2dMnZ/ebg+EO8vWrNV:7tDeGBcPVle8Vm9i5Ioanr+EfcN
  • TLSH
    T16CC4D41CFE81E819CD1A3EB3CFE914009B7121C1AF2195462149AFFD87A63B658E767C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_nbszmiyxtaxdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1