Extracted

• • Target
    2026-08-19_11033bf7cb64d3777b0f1709a628a7ab_cobalt-strike_glassworm_njrat_satacom_vidar
  • Size 60.4MB
  • SHA256 35f3d00f39edfbc69c3e23d32e64a0065111d356fb42afa4f7bcd12fe4df0d71
  • MD5 11033bf7cb64d3777b0f1709a628a7ab
  • SHA1 af86de3752295cf5d369d1cbf1b4157608005e56
  • SHA512 46c1770dc254d66c213b0dbb9b0080714654c22b4d117a70ba22342e5f29ab0002ff836fca754d22c6bef1e85f7fd4a5909c768314af6f0e19e657c216ccac92
  • SSDEEP 393216:S46Mb5vrfwR4Dc05FBdkUlGwd/qj0lc2lhbG8R1ZKxtqtCChsBfRI/VvJpXFmRGN:dmRo9lqQLlUqtWmVvJpXFUSI0/
  • TLSH
    T162D7AE15E3E84716E52FC2BDC663C113D6B5F8971312D6CF0414EA992F53BD2AB3A222
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessexecutionsheetratpersistencestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2