Extracted

• • Target
    2026-09-19_1de99526facf402eb90cedaf735d18e4_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
  • Size 13.0MB
  • SHA256 ea4638de61e910e42d18e1f4b933863b2c93b23521af8d5243aebd76a98ec8a4
  • MD5 1de99526facf402eb90cedaf735d18e4
  • SHA1 7197fcc7d06bfa767c08a2badbb78c096f027d86
  • SHA512 f24ac4c494fb52c9ff4186c58057d95ffbd7c2b463c3b169056d34573e3dede97c86ffb0aed0fda714f58a3cffa98d91ff89fb2e19857e6b5dc2fa839b4d6c9e
  • SSDEEP 196608:Vu6KJOKi1EJhfU89ovPcrIsPbfIlfrrVtB9cu248NLmvZXcRfYoKyx61vXN3:VFKMKNhs8+CglXVtB/aKvZMV8X
  • TLSH
    T158D6331E915210F0FD69A9BC5851A5E2CB37F823270476DB4291D2E2BF33EE48E37291
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2