Extracted

• • Target
    Client.exe
  • Size 549KB
  • SHA256 2b2b2543eeb29a31f989e09a84717176ee8bebad7f31a7e02d1606c7381db854
  • MD5 a3cfdef3c5fede25bc7a644ca837ce54
  • SHA1 fd7d2fa2d0a7a161d0a017846fd86434a6938e53
  • SHA512 63fd4ae8567626c7df5511732eae40a5a915b6a6fdbdf5348b7eacaed3642cb28cc42069f3ddfc942ed798ec02d0062c5436dc73b9ecfacc1ffd53a45872c8c7
  • SSDEEP 12288:bbag6zxRDaMePVle8ZB4bD9XU1hxyN/3X:bbaNxRDbaOpU1EX
  • TLSH
    T1D2C4B51DFE81F809DE2A3E73CFE920145B7121C16E22924621596FFD87663B358E267C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_nbszmiyxtaxdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2