Overview

overview

10

Static

static

10

test.exe

windows10-2004-x64

test.exe

windows11-ltsc_2024-x64

Resubmissions

03/09/2026, 17:28

260903-v2edjacq6w10

03/09/2026, 16:10

260903-tmp12sad2310

03/09/2026, 16:07

260903-tkszxsxsgw10

Sharing

Copy URL Twitter E-mail

General

  • Target
    test.exe
  • Size 559KB
  • Sample260903-tmp12sad23
  • SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratsheet_kzmcescgwtjsuthvradwarediscoverypersistenceransomwarespywaretrojan

Malware Config

Extracted

Family

  • sheetrat

Campaign

  • Sheet_kzmcescgwtjsuthvr

C2

  • 43.228.157.121:8848

Targets

    • Target
      test.exe
    • Size 559KB
    • SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    sheet_kzmcescgwtjsuthvrdiscoverysheetratpersistenceransomwaretrojanadwarespyware

    • Detects Sheetrat obfuscated V1.8 and higher

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Detects Sheetrat obfuscated version

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks