Extracted

• • Target
    2026-07-21_229a70e06858456c54afeb25f036a346_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 53.9MB
  • SHA256 701829635e439b4209d8974a8ca02b5dfce503d1fc31a537ff1fe8b996e58d50
  • MD5 229a70e06858456c54afeb25f036a346
  • SHA1 6974d0377c059ae67f38aca7a564723a3c0b3c78
  • SHA512 25f29aa8d0857e9aba191458d16e061a3de6f81c4e7500d996a7156bc48681ebfd7583c313dbd736fee97056845ad0c827c213c88734c3673d1d92e8c2a31276
  • SSDEEP 1572864:j2f7v8/e/W8dVkcz1sDQirbGVHy1Ak08m81KxadPhXj:j2Tke9t1sDQirqUKkiG
  • TLSH
    T16BC733AA511A0C8BF43685BE9541EA38D7427FC12F6A838B11F51D0BFD6778B0C396B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcredential_accessdefense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationpyinstallerspywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2