Extracted

• • Target
    Servise.exe
  • Size 541KB
  • SHA256 ad0324cf07522311681b4a23d106f44110768781b3185f643e2510990628c44a
  • MD5 a23c1d0db71aa923b8a8adc063bba517
  • SHA1 c64c7b3b9466ccbb93073abd4ecdb033feb46782
  • SHA512 98dc18e7434d9e6d3ff2d76c8231de5df98373a128ea18d963bfc13df240d31ea05968fabce7e93d69e9254bce92747b606040bcc5384327627451c4c40e3f42
  • SSDEEP 6144:L7KmpOg0wHLW49/+vSKLhpOpb84O3SvAVepKFLxfpeX9cA9xbX1sNnn1JFbkQmuy:L3pjIScpw84OLFpkXmQJ2B1JBLn
  • TLSH
    T1C0C4900CFE91E804CE1A3DB7CFEA11004B7160C1AE1196963169AFFD8B553B35AE667C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionsheetratpersistencetrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2