Extracted

• • Target
    Client.exe
  • Size 581KB
  • SHA256 3e30c04a45f5ded33619a1e6b90f8ce100b2780d9296851ae5891a3d89bfbd14
  • MD5 351b2defb7d93a4a05e2ca7675f4f231
  • SHA1 12a4f7972b71c585e23d9bc9f1299a1650638597
  • SHA512 4e4075df80c4905ff91644f70630e03657f5dd8a70a9389ac8845a3a58448974fc9d1199f8a76c51bb96e23c74af0dec07598293e1041079f7d86c343c1aeac5
  • SSDEEP 6144:xg2z4rsAx2OItSCkG2nMCje6VlWT8b9rlXhrSnkHfYSMyVkY+qihBTbZ1UgOMvSX:xg28rpxcsCCPVle8JlpSnafYfyklaMw
  • TLSH
    T1B6C4B20CFE91E805DE2E3DB7CFEA15004B7165C1AE1196462109AFFE8B653B359E227C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_igxxpgtxasuwdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojandefense_evasion

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2