sheetrat | 71624d843c3e977b00b6d925354d2ad9cbb20b0d36fcedb032fddc67e885e30c

General

Target
ybcfamtduig2z2nq.exe
Size 375KB
Sample261023-s47rradb69
SHA256 71624d843c3e977b00b6d925354d2ad9cbb20b0d36fcedb032fddc67e885e30c
MD5 411455a9c25cabc480ae54483fbde3a3
SHA1 dcafb9424e3ba9676aae977178561099721d18ba
SHA512 db784455876f18c8e197f473d727a437ec29a038364ca990d0cca58f06961694342604d32a93678b32d833aa6c7606ebbd4d8236b8cc5f053ae8539ada2ed9db
SSDEEP 6144:JcBMA9wz4ZoeETEW1gbpJA3KpSL0pDoYlKb3:JcBV9ULePJA3KY0p0cQ
TLSH
T110845A43B7D000BAE5BE453844735A19A73AF8115B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ybcfamtduig2z2nq.exe
- Size 375KB
- SHA256 71624d843c3e977b00b6d925354d2ad9cbb20b0d36fcedb032fddc67e885e30c
- MD5 411455a9c25cabc480ae54483fbde3a3
- SHA1 dcafb9424e3ba9676aae977178561099721d18ba
- SHA512 db784455876f18c8e197f473d727a437ec29a038364ca990d0cca58f06961694342604d32a93678b32d833aa6c7606ebbd4d8236b8cc5f053ae8539ada2ed9db
- SSDEEP 6144:JcBMA9wz4ZoeETEW1gbpJA3KpSL0pDoYlKb3:JcBV9ULePJA3KY0p0cQ
- TLSH
  T110845A43B7D000BAE5BE453844735A19A73AF8115B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery evasion execution exploit sheetrat persistence ransomware spyware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2