Extracted

• • Target
    bomjt.exe
  • Size 565KB
  • SHA256 433ff820fc808adccb7cc86f9d3eaad9b935bf4486bfe3473a7c1a0eb1ae4428
  • MD5 b40d5fd0a4be67ba6415d48db1e78f2e
  • SHA1 ed6b2da7d113679eec354f3e1392e2bb227f1fca
  • SHA512 3400774a50ebc7887de3f2b415a2ddbcee9064255ade2139d6af31563854ffdb82e4797553eb7ffc539c1f5525d1c4bbe7c8c9e99486d7787e11357936e404ad
  • SSDEEP 6144:0uwPwSGIm0tPq6a64uMvhy2NRMUdfMZcZo35kXKimVuqmuAxd1cLPYeub0jpeb9q:0z3SbhyPeECa8puI12Uebv
  • TLSH
    T18EC4810CFD81F806DD1A3EB7CFE918109B7121C1AE2195463159AFFD8B6A37258A727C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_kzmcescgwtjsuthvrcredential_accessdiscoveryexecutionsheetratpersistencespywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2