sheetagent | b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b

General

Target
b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b
Size 1.2MB
Sample260910-ler7fatzaz
SHA256 b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b
MD5 00757b6e7ffd502dffd4988f4579af2f
SHA1 4fe99128bc65aac74be95c4f492593f0e33eb206
SHA512 4ad5a9d94db448c1b704f359c84ec912a36563af97a7aecb5d778cb9c3599d91686672182f4b7da96fb897b552ab2d9c397b14ca68765e84713e30daa920db18
SSDEEP 24576:fJePU9GuLluUdIj3L06iCg4WTXyU266ZFl+RDXesHJL7HJIVipYoGkANB:f4c9G4ubEt4WTiUUtIPJLTi7oDA/
TLSH
T1254533EF24B467E0E278B657352BB462D1C394CFE0762FEC7922C325A4B82274271719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt apt36 transparent_tribe rat sheetagent

Malware Config

Signatures

Family: SheetAgent
SheetAgent is a .NET-based RAT used in Operation ShadowRecruit, by APT36 aka Transparent Tribe.
rat sheetagent

Detects SheetAgent RAT 1 IoCs

apt apt36 transparent_tribe

resource	yara_rule
static1/unpack001/ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210	family_sheetagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210

File Explorer

b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b

.zip 1.2MB
ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210

.exe 1.3MB

b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b

SHA256 b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b
MD5 00757b6e7ffd502dffd4988f4579af2f
SHA1 4fe99128bc65aac74be95c4f492593f0e33eb206
SHA512 4ad5a9d94db448c1b704f359c84ec912a36563af97a7aecb5d778cb9c3599d91686672182f4b7da96fb897b552ab2d9c397b14ca68765e84713e30daa920db18
SSDEEP 24576:fJePU9GuLluUdIj3L06iCg4WTXyU266ZFl+RDXesHJL7HJIVipYoGkANB:f4c9G4ubEt4WTiUUtIPJLTi7oDA/
TLSH
T1254533EF24B467E0E278B657352BB462D1C394CFE0762FEC7922C325A4B82274271719
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210
MD5 6bcf91af52b9577ba81cbae9368f91f8
SHA1 c1a691fdd339709439774e9402b71a4b4ba50f42
SHA512 355cf5bab05e2efa4505f906e7087c5560b8778ce038a294e34f2ab7f31183d3fe2c5bd9cdadd0cb698f621a26881b345fc9e31180a46d6e2d9e6cc6cafec517
SSDEEP 24576:U5NY5TL5Hl/fFs0YeLCvPoGyO22J35NY5TL5Hl/fFs0YeLCvPoGyO22J:UYBlTs9AC3yQYBlTs9AC3y
TLSH
T15755125873ED8A46E27B7F776CB162424FB6BA1AED25E31E24B0205A0983F41C551F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects SheetAgent RAT

apt apt36 transparent_tribe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1312610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\brain2\source\repos\Extractor funtions\Extractor funtions\obj\Debug\Extractor funtions.pdb

b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b

ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

b84c123963200711171a998011305cd56539450fdf522ce07bdb0d47927edc8b

ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210

mscoree

dotnet