Extracted

• • Target
    NursultanCrack.exe
  • Size 62KB
  • SHA256 62f03630b7e6de136e5408a1eb7bf2c4f113be620eaf8299e7193130daba3edf
  • MD5 e839e50d03676cdac86fc6a580412af1
  • SHA1 48af7b5ef1e773fe9966c6099f5b4ea594753b79
  • SHA512 ac62e0d0d6297364bad2093b86beae02ebab0b48b05f116b7d8209e2723c495bea9a9b8d09c3383e64481be9064009f9195873cdb3fc414c8101ba0271ea1d5b
  • SSDEEP 1536:OGBnvDqn92gkSxrAW7fabjk+oF8/hwldc1+:NBEkSxr/7fabjBoFog
  • TLSH
    T136532B00BBF9812AF2BE5F789DF221814AFAF1177903D68D5DD400A51A22FD58A416FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncratsheetratpersistencerattrojan

  • Async RAT payload

    rat

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  behavioral1behavioral2