Extracted

• • Target
    addaddaddad.exe
  • Size 514KB
  • SHA256 2fed9ffe89d053d0734d3dfaf3dc074e3e58b38bee222ef411a51ea5ac0d3229
  • MD5 b22b2ca45997630452dd1768d36aa3dd
  • SHA1 9a050f123d2aff0b96c119c30ac35c75870f3a1a
  • SHA512 a16e14c7fc7a837c2b3fd4266b6cdcde0b4e48dc622454f77c3ddbff316f3898a1a356c8b282aab34ddce6eceadf9cefc6928fec2a643ec6606c04ad828a3b46
  • SSDEEP 12288:wTxyMkuhmg0YMfD8T+XNjMw6En0dBidVuKvOfX:7wmbfDK+XXbrO
  • TLSH
    T182B417257FA98D00D580257E8A7E3609CB16E4F22502B347370AF7A24D459EEDE6C3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsheetratpersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2