Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.

Family: Sheetrat, NonEuclid rat

Sheetrat aka NonEuclid RAT is a trojan written in C#.

Modifies WinLogon for persistence

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

Detects executables referencing many email and collaboration clients. Observed in information steale

Detects executables referencing many file transfer clients. Observed in information stealers

Event Triggered Execution: AppInit DLLs

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.