Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 10:11
Behavioral task
behavioral1
Sample
aefd510d_.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
aefd510d_.exe
Resource
win11ltsc2024-20260629-en
21 signatures
150 seconds
General
- Target aefd510d_.exe
- Size 419KB
- Sample260705-l8feqsft3m
- SHA256 871932d648cac13509b3584cb7079bd030273d18cb9c22d52ec055ebdf38ebbf
- MD5 45b97a042a85974f20a87363efc5336c
- SHA1 e80a64ae3adfc24dbbf240211e55de19715c4321
- SHA512 79f56bbd7ba924312dd4e1280a14be00c42843b257b0e79b2e3e1265087d62cd2992a98b3a80d560f333f453c0d280b422c771c806e6846be0d716237c71f34b
- SSDEEP 6144:mbfB7n9aGIQnyVX1sR7f97TUBcqXF7sWo2Ngdu8TCZdibv3AfAI74M:m7n9TIWyVgv2NQuz0sR
- TLSH T1CA945D257FF5AE00E588143E857B2618DB21E0E2260373473747B6B25D0A9EDDE2C3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sheetrat
Version
-
1.8
C2
-
portbuddy.dev:43033
Signatures
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/1572-0-0x0000000000070000-0x00000000000E0000-memory.dmp family_sheetrat_v4