Extracted

• • Target
    checker.exe
  • Size 19.7MB
  • SHA256 fec16d5bd20ac2cd34adaa164b2e45ba7259da7db649af5ef65dc73ef140ef5e
  • MD5 38703f4ea618da4b0de6d0896c73fca3
  • SHA1 2d18880d878a46d9f8c53ad2f2a47c49316279a9
  • SHA512 36a7dd1d4b7c97160ffee06b5759533879ceab098ce9e87a1e5d99fccd779f954137ae1bdc186ef4bdc9632c312e1ac24c6c3e1411270801570376ab7ebed107
  • SSDEEP 393216:cyr7ojCsJqckaWuEs1VCBpgJBazqATpv9zEt7JUUe68l4jDhXgMA9lw8RJ:c0sCsZkPuC66xTpv5we6ThwMA9lw8RJ
  • TLSH
    T1FB27334C7C2108FBF1FC9679ACDF2E7362CA17854EA2F2682754237A1EBB1144E38655
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_rjknnhelcnbexecutionsheetratpersistenceprivilege_escalationpyinstallertrojandefense_evasiondiscoverymodiloader

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • ModiLoader Second Stage

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2