_.Helix.rar
- SHA256 cc9395dbeb9f288a86cfbfd7bea8b6e2d9a5e6c91b11884477289b43586dac83
Overview
overview
10Static
static
10.Helix/man...ff.exe
windows10-2004-x64
7.Helix/man...ff.exe
windows11-ltsc_2024-x64
7.Helix/man...rg.exe
windows10-2004-x64
1.Helix/man...rg.exe
windows11-ltsc_2024-x64
1.Helix/plans/CLI.exe
windows10-2004-x64
10.Helix/plans/CLI.exe
windows11-ltsc_2024-x64
10.Helix/plu...re.bat
windows10-2004-x64
3.Helix/plu...re.bat
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
.Helix/manicode/freebuff.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
.Helix/manicode/freebuff.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
.Helix/manicode/rg.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
.Helix/manicode/rg.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
.Helix/plans/CLI.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
.Helix/plans/CLI.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
.Helix/plugins/marketplaces/claude-plugins-official/plugins/plugin-dev/skills/command-development/re.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
.Helix/plugins/marketplaces/claude-plugins-official/plugins/plugin-dev/skills/command-development/re.bat
Resource
win11ltsc2024-20260709-en
sheetrat
1.8
t.me/junk_code
tcp.niceports.shop:20891
qqqqq333qqqqqq
true
rbmhw9c3kr60xnyj
true
true
true
true
rxcon7ti3euu4ee0y
%ProgramFiles%\Search.exe
%Windows%\Searcher.exe
false
false
ShellHost
CookieManager
true
true
Sheetrat aka NonEuclid RAT is a trojan written in C#.
| resource | yara_rule |
|---|---|
| static1/unpack001/.Helix/plans/CLI.exe | family_sheetrat_v1 |
File was altered after it was signed.
| resource |
|---|
| unpack001/.Helix/plans/CLI.exe |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/.Helix/manicode/freebuff.exe |
| unpack001/.Helix/manicode/rg.exe |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=259, version=30795,
count=140, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=33808,
count=16, id=260, version=33808,
count=41, id=261, version=33808,
count=192, id=1, productName=Unmarked objects,
count=22, id=260, version=34120,
count=238, productName=Unmarked objects (old),
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
Codesign digest Mismatch
File was altered after it was signed.
Jun 19, 2023
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US