Extracted

• • Target
    service.exe
  • Size 1.6MB
  • SHA256 de7bd08134ec885dae9dfeb90477b50c716775e8a2b0e161475bf26798b0adcd
  • MD5 cbc40096f994b3429a35fea43e209793
  • SHA1 0570bb6901625eed32c0b871a27e4dba7be78e18
  • SHA512 878eb3c26c691d7a6695bdd2816c649d1055ef54b6709dce60814b01ca0fd8acde1536bad6e6ca374c052ff35d5551a3a7d0071ef1bbeb68f17482ca4aa1b4c8
  • SSDEEP 24576:McJThDpgm50s20kLuU3Jvdq9k0Eir5bIvwGn6X:MUNDpgoz20kLc3r5bGg
  • TLSH
    T1F4755E0CBD91E804DD2A3CF7CBF550C20B7926E1EF959056201DAFE99B563B219E263C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_sklddsbwesgdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2