Extracted

• • Target
    Starter.exe
  • Size 557KB
  • SHA256 ec1744b217ec42dcc660c368acbe4545aa786946bb1983a16ef3ae64d5feea82
  • MD5 83441374984b6c74861b1f25e82c0d04
  • SHA1 d49e951963dcc65776004406f2bb144d405c94ef
  • SHA512 7e7b8c67fd05ecb429393fc230b8138e3db70f1274bdd875fd150f1ac9ad8e889c9e38cfcce72cb646baa7b1a9178b657288faa1cd8a684f667b0843b925354d
  • SSDEEP 6144:DO6uRVsh3z+W1sHb6wfutSje6VlWT8b97SHm4JYelFRbsel/QnmN:DO6mV6gH+wPPVle8TESelQnm
  • TLSH
    T19DC4C31CFE81E804DE1A3CB7CEE915101B7161C1BE119646310AAFFE8B663B359E667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_yqdwqhqquwnotncredential_accessdiscoveryexecutionsheetratpersistenceprivilege_escalationspywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2