Extracted

• • Target
    5fd3726cc58aa63531cdb3bc114faabc0e6ca9045592e3ea636cf3ac31177bf0
  • Size 6KB
  • SHA256 5fd3726cc58aa63531cdb3bc114faabc0e6ca9045592e3ea636cf3ac31177bf0
  • MD5 7119720d1727b5a7a38a2d7e2e3964d7
  • SHA1 040b95624dacefb73e5a318f5f87aa61569160e2
  • SHA512 3c77a98b6de622dd3a7ed13fd7dd06ea4bc4c5bdf2dcf51f071dbc126b55f35650b57c41f41c0c83e59194058f5402e03424cc4a398c1658295a1411dcf44647
  • SSDEEP 192:mHGud32oGEy/lNmg4laJJJFkms7maJM4wV8QR6:anl5GFV4ag
  • TLSH
    T199E1D7153A1CA59451B34E65EAD3A058FB13C03B475B0A18B9ECC3DA1F35169C29CF5E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ayudiscoveryexecutiondonutloadersheetratloadertrojan

  • Detects DonutLoader

    loader

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2