sheetrat | ad015c018476488d2569b1da5406b06cbd08638c00de7f492a43a5aa0faf7d5f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:45

Target
2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 428KB
Sample260808-2pn6jawblh
SHA256 ad015c018476488d2569b1da5406b06cbd08638c00de7f492a43a5aa0faf7d5f
MD5 848d8c0cdddabac42cc6609b8f3f6567
SHA1 72896f2dea1338985c90bc35249678f0d05c9a3b
SHA512 0045425f97a09f3643d11c6fac7dabca452814cf7dc170b8d916447b0d0ce056f6748815c32d2c7db6f1677cecc3b554850a1fbe901a21798ec46d59c3a7a4bb
SSDEEP 6144:UGcwl8PdipMsOKC2Jl8LXOut1DTChjPWIHG7p9kuQ5HHpZGtjhZ3mNFu+/WmNG7w:UG/PhoFCJOvkuQ5HeDILu+/Wm438
TLSH
T10A94AE22BA595CB8D457C07883458A636D7278CA0F31E8FF02D895352E6BAE57F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheetrat trojan

Family

Version

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x0009000000019cc1-2.dat	family_sheetrat_v4

Executes dropped EXE 1 IoCs

pid	Process
4332	msedge_update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4332	4984	2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Microsoft\Edge\msedge_update.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Edge\msedge_update.exe"
  2⤵
  - Executes dropped EXE
  PID:4332

msedge_update.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\msedge_update.exe
Size 362KB
SHA256 e3ba6b68f6cb4190a20c394517134d4847f0af40b9e2a15502b63e9ce029119e
MD5 b1235ff3b518faf281088b91a0f0f700
SHA1 6e1edf3c74b785dbcecbe47f5d5e75cd4aca13cd
SHA512 187ad95df63f9767a8bc16eda23e2a6e75a8eb131368e0e2e1ac5328def25e057afe220cb9722e65c8039d04a7299731f300acb4dd87e9d4962982befab39c49
SSDEEP 6144:HSBRd2rPBGwhguJfIURsH9GMeHgPMaqWQDwvIaEIC/3ojm8jb1lghI1os1w:ycrPHhHfUcYjm6
TLSH
T16074C6257FA58E00D451287ECA7E3609CB16E0F225026347370AF7A64D459EEDE2D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download