Extracted

• • Target
    Client.exe
  • Size 478KB
  • SHA256 3b577b3d2df27c031e60f60aa1c92032cc9316207fb036c02886f2e1cf21e14a
  • MD5 51ea4486faf3ff7b5689c608dbc529b4
  • SHA1 8125b4c756f8ea53c5bd778ec78625ef5d2a48bb
  • SHA512 86581d25dba0bdcc77dc2df7343f7e2ef35aff3caaf7d2d689424b4cea6a0565989aed3f0929c34c81c2c0f4e19f10bc2e7dd9b3671099c1fd4e3dd524b1d544
  • SSDEEP 6144:QZSuouUTtqWWtXQIc9PAhGGxe6VlWT8b9I8V1nsqTjDNF4bU6bEv21qk2oV:nuou09WtLY2GqPVle8C8vTjhl1k24
  • TLSH
    T197A4A10CFE91F809DD1E3D73CBE514144BB165C16E219282266AAFFD8B563B348E267C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_sljemcznmwdiscoveryexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2