Extracted

• • Target
    BadSnoser.exe
  • Size 448KB
  • SHA256 9fe3e8ff6f4b59664cba71dc6f629c66a8de5c767f1cb695e11b2f0fc4d51c32
  • MD5 df996ffdaa6f2d8b86ec2cd5352be550
  • SHA1 dcb4a005eb5aff0fa813f1a1e395883931eee81e
  • SHA512 4742282373ca4730a89daf49029c7570cb98625f8b31cd4bf583838e94fd585dcfff9fd3bdefc5aca2f9345bb8191bda8563bc8d61e2f49854a5d14cd072758b
  • SSDEEP 6144:Xe4Oe+SBs/6ByIiue5b82Lv5JDaTwmg0naBcMBqYgdq:jO7S+jIBe2aOTi1BcMwHq
  • TLSH
    T1E6A4C8A7B41E13DAFA2E22BA602E04821BE52073E917512E31D9F57708C531A597FF7C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  snoserdefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat Obfuscated Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1