Extracted

• • Target
    Client.exe
  • Size 322KB
  • SHA256 82d7af76c1305cffcd7925c62b5f1d525f446be09509fea7881fdeaec700c710
  • MD5 118d9ea9e434d6ae0262c3b52f956ec3
  • SHA1 4f1f05a8e68f16747e1c9ece4c7ddc49f15e2ae0
  • SHA512 09749b01b9b7398e67e12abbfcdef2e104e592304a9acaf51ec34a6b6e89175ea798e61ce022346c7fb1779a59c282bfdd9b397fabd9624bc30933ecbae61f77
  • SSDEEP 6144:CAblEYQHiXpMPVoe6VlWT8b9yDxgrwTW/N+b2BWQ:/mVS6ePVle8Imay5BR
  • TLSH
    T17864D50CFE81E805DE5E3D77CBE610008B7125C22E22928676596FFD8B5637758E62BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_qwrqrmioqhvabiexecutionsheetratpersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2