Extracted

• • Target
    ArdorFast.exe
  • Size 23.0MB
  • SHA256 bc5277628f40af4d577378f8ae183ad1e056fc11c9f4857746c8b81db0a4c6ff
  • MD5 9aeeef3062c5eb45e7e6b22388ac1580
  • SHA1 fa108f01ae31185012216c776333bf69e980bb76
  • SHA512 5fb0df374c4389b99dbfae2bac05a6959c8f422580aa3a07f0289bf3a4e42d6820fdb6acf398da318843ee1bb7b8a10c6dd1f786a09fda1d734ed8b5ff14f11c
  • SSDEEP 6144:IcQCw/nHKlDVe6VlWT8b9g2qAyj3Ixe1b3mHdz:ZQwHPVle8unX36Ke1
  • TLSH
    T19437E41CFE81E804DE1A3D77CFE610109B7121C22F219256365A6FFD8B593BA58E61BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_qwrqrmioqhvabidiscoveryexecutionsheetratpersistenceprivilege_escalationtrojanadwaredefense_evasionransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2