sheetrat | 43ac530c20f3d297d4a0d4b6607f3ce1318c8a0029f843be39a6db55e6e3c9c6

General

Target
ExclusionLauncherInstaller.exe
Size 602KB
Sample261111-n4b8maws5k
SHA256 43ac530c20f3d297d4a0d4b6607f3ce1318c8a0029f843be39a6db55e6e3c9c6
MD5 8a79d84dff7f29011a793a2c589df460
SHA1 4401912f7d6c8ed291a420e9e8fd97efc2ca12bd
SHA512 8bc8fddfa28790847d9f7f6041ddaad168ce16310209f84fdc8e3915213512bdf0d4bc4c0c4caadcee6c8f8c12f6e324ea6cbe554a6100b0a1d5a4fafa7b506c
SSDEEP 12288:OwbHUMdGkxLhb5P9ULePJA3KY0pQwAfPJioSBBdHfha:DbHXlbJ9UqPJA33wAUoyHfha
TLSH
T109D49D43B7E504B9E1BE867948726614A77AF8114B72EBDF169404ED0E23BC2DD34F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ExclusionLauncherInstaller.exe
- Size 602KB
- SHA256 43ac530c20f3d297d4a0d4b6607f3ce1318c8a0029f843be39a6db55e6e3c9c6
- MD5 8a79d84dff7f29011a793a2c589df460
- SHA1 4401912f7d6c8ed291a420e9e8fd97efc2ca12bd
- SHA512 8bc8fddfa28790847d9f7f6041ddaad168ce16310209f84fdc8e3915213512bdf0d4bc4c0c4caadcee6c8f8c12f6e324ea6cbe554a6100b0a1d5a4fafa7b506c
- SSDEEP 12288:OwbHUMdGkxLhb5P9ULePJA3KY0pQwAfPJioSBBdHfha:DbHXlbJ9UqPJA33wAUoyHfha
- TLSH
  T109D49D43B7E504B9E1BE867948726614A77AF8114B72EBDF169404ED0E23BC2DD34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2