Extracted

• • Target
    Client.exe
  • Size 300KB
  • SHA256 fd10ee96be5590c15197ad1f44f512bef2066f273f1a200fb7adad1f7276aa7d
  • MD5 9fb7ccc0aad7e4ca5602168038861134
  • SHA1 8e5cc214a6c921accd5859ee5b592a1cd36d1ed3
  • SHA512 1c637e738b6698a7cc46d6293e7c4ee26f382df961a7435a0d0a2ba9490e3edc8fd4257f944f045f71bb6ae8d731d35f51ec1365eb97e37340e8948603bac8cb
  • SSDEEP 6144:8ELlat+Wtg1Zle6VlWT8b9QTgFBSjnbQz5undFZ1n:8EBdPVle8C0W6undr1n
  • TLSH
    T11064E60CFF91F804DD5E3D3BCBE610118B7125C22E21928636996FFD8B953B658A61BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_wzymlrvgqijhlcredential_accessexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2