Extracted

• • Target
    Xeno-v.1.3.60.exe
  • Size 84.8MB
  • SHA256 40b7ae6ba61e438679fd79082a5f904a82f0652323a5a0973262336dad32adfd
  • MD5 1367cc8aa503c5e4470b11916ba8577e
  • SHA1 ec6832fab698f3cbbbf2a0411f02b883187ff1dc
  • SHA512 96a46d3776d9839bce7a2b1f70a24732583c62f4c169630588c151da2f91a72cbd4f958c3783d3ecb53301f76794da48e710fb7fbead1cc08dce4776204cfb8c
  • SSDEEP 1572864:RJ10uA/WwaqmnxIZmF0TOSwvzrxt1uxSn6ryxXWJ2s3vUBO:RJhAeJIZ7Tbwb3IxS6rOWJh3v
  • TLSH
    T1D5183390DCCE35AEC86CD0F4ED60B20610A8D24FE954AB23202F57DE7DB749A4DD2997
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_nbszmiyxtaxdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2