sheetrat | test[.]exe

Target
test.exe
Size 559KB
Sample260904-rpkg8sy1fv
SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
MD5 351f4b952189219295d0ba391905f67c
SHA1 45dcccd2b8b4bd5a66be359e93d274d22f1393e7
SHA512 d626914339ad2925ccf92124725c829397cb3ad38bf8d6bc121cb45f6c83ee03d5dc19626947de14eebb13dcde986702ff8c44f0c233b64497e832ff93cc04d3
SSDEEP 6144:CpXWl7C+5e9HlLftj4kLlIFjKEM39/tB3GKVGcxwOY6UuuIYik9Jb2xe4/XZTsAw:CWGftb+8EeVnGck6tuSkOeMpTXvY
TLSH
T1D5C4921CFE91E805CD1A3E73CFE914049B7121C1AE219642315AAFFD8B663B658E727C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_kzmcescgwtjsuthvr trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_kzmcescgwtjsuthvr

43.228.157.121:8848

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
sample	Sheetrat_v5

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
test.exe

File Explorer

test.exe

.exe 559KB

test.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
MD5 351f4b952189219295d0ba391905f67c
SHA1 45dcccd2b8b4bd5a66be359e93d274d22f1393e7
SHA512 d626914339ad2925ccf92124725c829397cb3ad38bf8d6bc121cb45f6c83ee03d5dc19626947de14eebb13dcde986702ff8c44f0c233b64497e832ff93cc04d3
SSDEEP 6144:CpXWl7C+5e9HlLftj4kLlIFjKEM39/tB3GKVGcxwOY6UuuIYik9Jb2xe4/XZTsAw:CWGftb+8EeVnGck6tuSkOeMpTXvY
TLSH
T1D5C4921CFE91E805CD1A3E73CFE914049B7121C1AE219642315AAFFD8B663B658E727C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Sheetrat obfuscated V1.8 and higher

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Detects Sheetrat obfuscated version
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

577310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

test.exe

mscoree

dotnet