Extracted

• • Target
    .Helix/manicode/freebuff.exe
  • Size 117.8MB
  • SHA256 55c64bbb78ab2a3cab6d5b9999f79d400f4ad44a92e6b723f04d638d79cb209a
  • MD5 7a32778a8fc027145090b3074d682de1
  • SHA1 429b53881ba198e1adb2f41f36b1d35de623f5f8
  • SHA512 fcee6b0d0fc0c543807a80876e056f9bd02e062b81c361f9f62c731b5198f3f74cd3ad9e2db4b54bc56e231c1e274399a3e0575151f7519a2fcf8fb6b21b7d0b
  • SSDEEP 786432:vMKVpL0NlvnOMVDLz9/W6PD3m6klrs9wbyfuGpgl5/8OzDuGe3F3/zEsm9iK5enm:vMKVSNV3z9/rmJAwbrF5e5A
  • TLSH
    T1BB489E03B2E75498E0BBC134D6FA5723A532BC454B3055FF26584B312F72AE0AB7AB15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2
• • Target
    .Helix/manicode/rg.exe
  • Size 5.2MB
  • SHA256 f162b54de2adfc72d78adb1dbada2dedda111ae0a5e2f6e9500f4f909664c5d2
  • MD5 221254977da4eec7b09733b68df6c15e
  • SHA1 a6cc52298c629a8c1b58087dfc8e640c57b057ed
  • SHA512 7348a343690de8be0730bb12105a245526c25e0f376c4d9ecd7e25d67b4fe382912596026db5ac54f6c2d38f27e8273741cb4e6589ec13b69eb4dc8063e54104
  • SSDEEP 49152:IBR0F5OaYXZIgAwCtYsXXEpHxHZYFQyYYorNO7u9l94BuHFG7QdmykDWhmZ/1j4W:3DQJQYwM/SX4F
  • TLSH
    T12C462A16BA9764EDC56AC074834A46726B31B0CB0B357AFF44D442393F6AAF41F3C668
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    .Helix/plans/CLI.exe
  • Size 62KB
  • SHA256 b3e37329a199dd8f353bb8e4bb2124c960f6b3e79d74b08f205b85b2dfa952e3
  • MD5 d37ea445ef643eaba701219731423605
  • SHA1 a0c63546c2499fb993fa1e69cb2dd3975031fa49
  • SHA512 8753cd674d8980e975ce1905d00e83c5901a34b9a513bceade2c08564a1c7f720d684a0adc7670e0dc177b4f415bd668d3a5fa8842327aa479641d3a0812d3d5
  • SSDEEP 1536:oD36IZAt0aJwE1sxSObnktyhTLsgIjGPxX:oDRAt0oB1WSObnktyhayxX
  • TLSH
    T182537C09B3848F21E8BF56BAA2967B20933CE2135442D7571FCBC0C57EA67C19D49CE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  t.me/junk_codecosturadefense_evasiondiscoveryexecutionsheetratpackerpersistencetrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral5behavioral6
• • Target
    .Helix/plugins/marketplaces/claude-plugins-official/plugins/plugin-dev/skills/command-development/references/testing-strategies.md
  • Size 14KB
  • SHA256 e6ccf78d85c23bc58582dbc8b91731c4e412568705ed2c87ac699a1ded9adc67
  • MD5 a750696ef7a8becfab019126313dee1c
  • SHA1 310a996bb9f360be9ffa1f6a7b3a1b6ea393417d
  • SHA512 7dec9186a696923cfce88509c61490fc9edea1b7413a583eac4b62a865c5fe510d56c1e591e2eb9ec40bf598e9ce89ccf945fa7792f28d00d9c51462c77335b4
  • SSDEEP 384:E+Q2KSklhi4qkjxNn2VDpxP/c4G613POpngJ0pAs:wlhLrGfFJ2pngJ8As
  • TLSH
    T1D062C655BAAE17610E9700D94C83F75BB695932F9202183EF4FE7438239AFD1906F358
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8