Extracted

• • Target
    Client.exe
  • Size 439KB
  • SHA256 ed937a6cfcfbd3c49efb8d1c21cd2448b89df509df51a70bd3e43d1bb2966527
  • MD5 2df745224b4107755cd35aa5c8f8f016
  • SHA1 921c1ff94a1288f42d2fc2549e07070c56b2965b
  • SHA512 e4a1a70a65f9c2e38ce95a826202ebda597baf513d4ad785417477bb03df54437594ab356f30fc967367f9c1dc937dc2cb38eb26731c54e2ebdbd78541dc5fa3
  • SSDEEP 6144:7iA7j1H0Y190A12Y1e+e6VlWT8b9EpkH8EcuZWbFNbj+qn75YJowWdl:N7xUW90A12kDPVle8BcrMG75mowa
  • TLSH
    T1B6A4A20CFE91E806DE1E3DB7CBEA10104B7125C16E1192523159AFFE8B6A37768E257C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_rdhxkbcnttdrkvzbfdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1