Extracted

• • Target
    2026-08-19_2bd7411ebcf1fb16e79bb72922222197_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 678KB
  • SHA256 8afd5feb33d4d17fe251fc73663f86568b5134e6b5b0005a25353775da927d4d
  • MD5 2bd7411ebcf1fb16e79bb72922222197
  • SHA1 8e333cbdefab29c11b58400d308a5972a3db1ef3
  • SHA512 62f17132e2427c170852485f5aadc36ce926533fa226aa3f6b538f96acd76d674c5312503464580ce34347c37c4c7ba13c5ce023e5a456d5fc563d08bcf85321
  • SSDEEP 12288:+bQIi8rXTWcJHsp63L2tf6QMg5huP2DYV0qXONJy0Qy0UF:+bQfQjWKM072B6QMgf+2LOO60V0UF
  • TLSH
    T1C4E4BF09E7E804F8E0B7E1B8DD665942E77A784D0771D78F07A446662F233A09E3DB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_jbzputqwapdnfcfbixcredential_accessdiscoveryexecutionsheetratpersistencespywarestealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2