sheetrat | 36a8548fc9919c064c4bec7dc671c3a6f8ac396f7d787f3f39507d1474f0673a

General

Target
Holy Check.exe
Size 445KB
Sample261112-yn2tfsbx7m
SHA256 36a8548fc9919c064c4bec7dc671c3a6f8ac396f7d787f3f39507d1474f0673a
MD5 2ebfc360dca8b60c7d6148f38e4540df
SHA1 17a61dff2034a9d1afa9925b668f2ce8036883f5
SHA512 104a2ad0328eae5e702a3d2338e4c18c14e7dd39d9801e62993199397a394e36e031754d25e8b9220a5f2f776c8d5f7f9d9a54d821445072d10b214135fa9ad7
SSDEEP 6144:jUNb/ojTbf1Gx6dC9wz4ZoeETEW1gbpJA3KpSL0pDo0UbEdCDEpUP:jAb/ojTbf1m689ULePJA3KY0prWDEpUP
TLSH
T143A45943B7D504B9E5BE863848735A14973ABC214B62EBDF169424ED0E32BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Holy Check.exe
- Size 445KB
- SHA256 36a8548fc9919c064c4bec7dc671c3a6f8ac396f7d787f3f39507d1474f0673a
- MD5 2ebfc360dca8b60c7d6148f38e4540df
- SHA1 17a61dff2034a9d1afa9925b668f2ce8036883f5
- SHA512 104a2ad0328eae5e702a3d2338e4c18c14e7dd39d9801e62993199397a394e36e031754d25e8b9220a5f2f776c8d5f7f9d9a54d821445072d10b214135fa9ad7
- SSDEEP 6144:jUNb/ojTbf1Gx6dC9wz4ZoeETEW1gbpJA3KpSL0pDo0UbEdCDEpUP:jAb/ojTbf1m689ULePJA3KY0prWDEpUP
- TLSH
  T143A45943B7D504B9E5BE863848735A14973ABC214B62EBDF169424ED0E32BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2