Extracted

• • Target
    pic‮gnp.scr
  • Size 849KB
  • SHA256 ab4c6cea16907b2b1aeb906952eec59324e119609383c64389e6bb09e681df20
  • MD5 bb9f5d2cf1815379b2d0215ec93bfddb
  • SHA1 bc4cddd7008a603756da6446dcdddec0dd69e095
  • SHA512 dda9e51f3a89e20cfc5f2ccbd1efc2dceb93b3e205cbaca26d72522d8e1740e1da0eb7e74a81851044bc649b7dc9c040b744b58ef8b48427b40335cddc203ed1
  • SSDEEP 12288:teOXaRsdIeEHuRcgaNgf5aKulaMrH4SQHDv21Mq+FHO4dljaSp/MoMwcad:tekGsd8Hu6Ngf5aHlaMz4S48gD/xca
  • TLSH
    T1F805E01EE7A445F8E067D1B8CE528942EB727C4D07719BCF23A45DA61F272A09E3D312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_chmcfvtmqoqlexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1