Extracted

• • Target
    Clientt.exe
  • Size 596KB
  • SHA256 bb0d993f1af574c669eadb7a9801a6be973d04f2a98914d5fd03d083f9280a17
  • MD5 050c49c0ff975502e7d8f601ebd7042b
  • SHA1 707a1ecf2c54ef534fa0e0325237dcf885abdb57
  • SHA512 9b9b75c023a28c685f46db7d7e41fafc0cc76059dca200ce66f15b634d9baa5be34ae93ac68a0aa1202f5dc7d65ace5e20ce367085b63acc3bdc0cbf3ad37e1c
  • SSDEEP 12288:eS4ZVm+qOPVle8IPikMTnUbLTHclkSrauIvVqc9Bh:eS4ZwbpikonUbLTH0D
  • TLSH
    T1D9D4B40CFD91F846DE5E3D77CBEA15044F7220C12E219256250AAFFE8B6537358A2A7C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_ffrtgqljmlghlkinvdefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2