Overview

overview

10

Static

static

3

2026-05-22...rm.exe

windows10-2004-x64

10

2026-05-22...rm.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm
  • Size 11.3MB
  • Sample260522-e8ae6aht3v
  • SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratsheet_tcwjcmmwqyakvkdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 2.6

Campaign

  • Sheet_tcwjcmmwqyakvk

C2

  • 195.226.92.129:20320

Targets

    • Target
      2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm
    • Size 11.3MB
    • SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    sheet_tcwjcmmwqyakvkdiscoverysheetratpersistencetrojan

    • Detects Sheetrat obfuscated V1.8 and higher

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks