Extracted

• • Target
    chekerexe.exe
  • Size 315KB
  • SHA256 81146895988583cc2f0b19dd7cf88d8a6e73bfe54e3a25c19a914523b33f5e8c
  • MD5 94edd89be35abc436bfa3c8b540f4a3f
  • SHA1 7842c1cf8a5cd60d3d893fd1a8bd492a9d780a39
  • SHA512 6a38af1afb15333acde1a19164c87dfc2cb2050c6b700cd62c89dabd40e04c984ca97703d182d8ebdf0478be46123a2369189a4322956b15176910f9fbb96704
  • SSDEEP 6144:ywSDr+uiTLzWCNe6VlWT8b9H1c5zbfNRxgL:aSfTzPVle8N+zrw
  • TLSH
    T13064C30CFF91E805CD2A3D77CEF610144B7126C22E219252764A6FFD8B6637768A61BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_rjknnhelcnbexecutionsheetratpersistenceprivilege_escalationtrojanadwaredefense_evasiondiscoverymodiloaderransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • ModiLoader Second Stage

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2