Extracted

• • Target
    lastlasttest.exe
  • Size 335KB
  • SHA256 711501fd7f29b9cf03e0cf2de88b4938674067cfa9ed121a9de1ca71e46c55fb
  • MD5 8ba05e2defff0a15ffd01b79cc98fabe
  • SHA1 45949e98d1bc1e5f5182575673a6a9d17b6cd4ea
  • SHA512 9799771bacebed00fea5545a1e478f8570eee83015a3cdb9e6c865ecd431e961b33a8710eefb577f2b266ffad2e385c30634be1e40016f3a4aab58f331c2acd8
  • SSDEEP 6144:i6BfA3mzXPoe6VlWT8cBHRLJJkpqIOA5beCe:vfiUXgPVle8cpRFqp0A4
  • TLSH
    T15474E50CFE91E805CE2E3D77CBE610004B7165C26E219356324DAFFE8B5637658A66BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_refreshedoqvlhkxsapgzwexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2