Overview

overview

10

Static

static

10

2026-08-18...ar.exe

windows10-2004-x64

10

2026-08-18...ar.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-18_0d6d101ce2335fcd5d9475d7f3422cac_cobalt-strike_glassworm_njrat_satacom_vidar
  • Size 59.9MB
  • Sample260818-c265facr61
  • SHA256 c3e0badd9e2a025e5d11bcf639fd1ca25007035c379df481cf42678f41f50cd8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratdarkscriptdiscoveryexecutionpersistencetrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 1.8

Campaign

  • darkscript

C2

  • onedrive.localto.net:3554

Mutex

Attributes
  • anti_virtual

    false

  • certificate

    2b0uy3

  • exclusion_wd

    true

  • hidden_file

    true

  • install

    true

  • install_watch_dog

    true

  • key

    hywobq5mn

  • path_client

    %Windows%\System32\sfcc.exe

  • path_watch_dog

    %Windows%\Web\MalwareDefender.exe

  • pump

    false

  • rootkit

    false

  • task_client

    Microsoft\Windows\WAppCrashNvTew

  • task_watch_dog

    Microsoft\MachineCore

  • use_install_admin

    true

  • user_init

    true

Targets

    • Target
      2026-08-18_0d6d101ce2335fcd5d9475d7f3422cac_cobalt-strike_glassworm_njrat_satacom_vidar
    • Size 59.9MB
    • SHA256 c3e0badd9e2a025e5d11bcf639fd1ca25007035c379df481cf42678f41f50cd8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    darkscriptdiscoveryexecutionsheetratpersistencetrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks