Extracted

• • Target
    rjvkkwvjcvpo.exe
  • Size 442KB
  • SHA256 044d8e41acb7ef6ad30c8e74f48044d7811d2d8110f088f281ebc697525b3b48
  • MD5 af5864a3414f5437da8360e98387807f
  • SHA1 de232688fffcc9b5707be1a6c5600027683a8792
  • SHA512 e161acf4571893f75c6b890a9098d9366b89fdb86335ccec690869d99ef8688b06d2921149c597ae84fe1318758a49c51feed3502ee9138c01ff8ed16379c548
  • SSDEEP 6144:oRZ7dZocBd7UhOJws7WR0Sl88rlCe6VlWT8b90pcPa1/OZqb5pXQh8:W4cjcOJwSW88EPVle80cPsW25Qh8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sheet_vxaqckwtpxtvhoiagsexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V2.0 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence

    persistence

  • Sheetrat family

    sheetrat

  • Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2