Extracted

• • Target
    nevirus.exe
  • Size 576KB
  • SHA256 39e67b678adbf0019fdb5901bf004ced25a00216cfc808b5fee3de22e932eab3
  • MD5 3fa6a2fa277793be498922fac2d359d3
  • SHA1 b2ae43f00b03b46dde5d2befbad6c78823a43334
  • SHA512 db0b517f2b820acdbed878aedecf870decd735504039a5b9078ae8fdbe2d72f60d02dfc0ec3c9493747efa07fb25a0796029ad5aa1bf112027f797670d0443b6
  • SSDEEP 6144:wwEmj8qkCwKWgPeae6VlWT8b9WyQk6PYkzEaUeVYcLSnbklz25bRt:wfmj8HCBbPVle8tKYxajOYlzED
  • TLSH
    T12CC4B40CFE92F805DE1E3DBBCFEA11004B7165C1AE5195422149AFFE8B6637259E227C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_oltgluyntjddefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2