Extracted

• • Target
    Wild neverpasta.exe
  • Size 263KB
  • SHA256 a53ba194252795d796412bb2cafee074b5bb298bc1b9efa29994bb78799df92f
  • MD5 fe530c15ed38edc058e4be1b1943e1dd
  • SHA1 9cddf4d8bf782d62cd968e117b3e8658bb7f1572
  • SHA512 b2fbbcc355c968d240dd67952cb415a225bc846ea70f5b6a95c6e22048424ac45dd566d70e2f3e9c606a2d0877e208a670acddc08af6be0a243e6b934b3ab3cd
  • SSDEEP 3072:WgBWBqRG6rvzbZPHy6858M0qNeN3w/jhlhE1Z8Nig95OZx0ASUHi9Bds3b0kawWF:W5IGsq685Npe6VlWT8b95IS/1Gbx
  • TLSH
    T10044E71CFF91E805CD6A3C77CFE610009B7225C22E21A25276496FFD8B553BA58A71BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_ywurkofzmzzodiscoverysheetrattrojanexecutionpersistenceprivilege_escalation

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2