Extracted

• • Target
    Morphine.exe
  • Size 341KB
  • SHA256 1bedb15ab373379bda80a6702ca7879b7ed0a331473785bb9722902d8598972f
  • MD5 f087f56fb86d66547d43db3b2f454952
  • SHA1 7d3e86b66438620c159d510aa97ee2369f4b5a5a
  • SHA512 c0f518e601b5540f60a32e2754f28d13aa382833092506743743e95614ab3403e7f43b79b6c18c2088ae4b7006791388daaa502edb81fb7bb5f77e5ced7ef7ac
  • SSDEEP 6144:eTYw9ko1KoFq2TCSe6VlWT8b9TvAvgVxOuKbE0ahn:GYKkoRDPVle8Qgj
  • TLSH
    T19C74B40CFE91F805CD2A3D77CBF610144BB122C22F2196463659AFFC8B6537698A65BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_qwrqrmioqhvabidefense_evasionexecutionsheetratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2