Extracted

• • Target
    ФВФВФВВФВФВВФВФВВФВФВВВВВВВФ.exe
  • Size 360KB
  • SHA256 4f9580f90a63d7a1097b0c3f4c6f7052d2c6416d5dc8f23ac28f87aa58178783
  • MD5 4a6ffabbcd3910de892d657e02b434fa
  • SHA1 8dc5db0ef86fb238320de317a4e8f96ac439d783
  • SHA512 642b153a18bca298a5cb144ee4c852a14a7779a1592d35be97f69ec71204be8fef52abd9eebc95141dc769fbd867fab19d30098e472cb7942b6f615d6b6459d6
  • SSDEEP 6144:z3kqAua7Wec288hJVBvGtLvIfHTlZ0EpNE8VLNpGbxaBpKUvR7:TdAuaW72Xfzl+EpDhNd6qR
  • TLSH
    T1987494257FA98E00E584147ECA7E3609CB16E4F225026343370AF7A25D459DEEE2D3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2defense_evasiondiscoveryexecutionmodiloadersheetratpersistencetrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2