Extracted

• • Target
    Solara.exe
  • Size 31.0MB
  • SHA256 202b7d774a433ce589b6df96545e09fbd393eb6bc538064052e0c6d9dbb1c482
  • MD5 3d40d66271146003b499c7eac08233f8
  • SHA1 d35d7f3bd548c15898880711ede0342f7fafc97f
  • SHA512 1c7c66f5795d94d43df9b0f0b1382bb2a66eedd64805c0617e8677a5d61a6c2248471d5ae11da6abbf496a380d9b83f68eb987ae6e36ea080fb6324d1c995219
  • SSDEEP 6144:dwT5oZj4kxhZsxe6VlWT8b9R9EjmvyxGybgaCuThbFWE:WT5okPVle8n9UDbRCu/W
  • TLSH
    T15967C30CFE91E805DE6E3D77CBE610004B7121C22E21929676996FFC8B9537658E72BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_qwrqrmioqhvabidefense_evasionexecutionsheetratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2