sheetrat | olf1d1kqjx6nkhnz[.]exe

General

Target
olf1d1kqjx6nkhnz.exe
Size 181KB
Sample261023-m3c8vsbs21
SHA256 cc25b8243b1d5dcdd86d74950063ffc3de60516c56585af2414d7bee3efb6936
MD5 110904d0d38f8892720c3498c81ee136
SHA1 96af6a8bfa7178a01716321669330e66eefa73de
SHA512 a9935c19e1ad43847c706c17b60bccf5f5a13d99242d1f5b5774b477a73817b328b5e0c249b55ec167c6e7809ffecee037c8dbb05086eb6120bec8c81590d4ca
SSDEEP 3072:gEHTjB5jGRXCWQ/r4z8RF5gh+rx/pvU98vdy1TzW4iY/gkYtdWhObl7FEG0:Z5u/O4QVm0BG2vdy1TbD/8Wwbn
TLSH
T1A304F140B7D896F1EA9F46BE53528208A275C1738C47C70B7DCB8DEB25423D6A716CCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Version

1.8

C2

openport.pw:40131

Mutex

Attributes

anti_virtual
false
certificate
cfxobj705xusxlh
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
true
key
kvkgxv65dh1k
path_client
%LocalApplicationData%\xdwdxd.exe
path_watch_dog
%LocalApplicationData%\xdwdbot.exe
pump
false
rootkit
jozymk4w6rtdpu
task_client
svchost
task_watch_dog
svchost
use_install_admin
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v1

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
olf1d1kqjx6nkhnz.exe

File Explorer

olf1d1kqjx6nkhnz.exe

.exe 181KB

olf1d1kqjx6nkhnz.exe

SHA256 cc25b8243b1d5dcdd86d74950063ffc3de60516c56585af2414d7bee3efb6936
MD5 110904d0d38f8892720c3498c81ee136
SHA1 96af6a8bfa7178a01716321669330e66eefa73de
SHA512 a9935c19e1ad43847c706c17b60bccf5f5a13d99242d1f5b5774b477a73817b328b5e0c249b55ec167c6e7809ffecee037c8dbb05086eb6120bec8c81590d4ca
SSDEEP 3072:gEHTjB5jGRXCWQ/r4z8RF5gh+rx/pvU98vdy1TzW4iY/gkYtdWhObl7FEG0:Z5u/O4QVm0BG2vdy1TbD/8Wwbn
TLSH
T1A304F140B7D896F1EA9F46BE53528208A275C1738C47C70B7DCB8DEB25423D6A716CCA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing