Overview

overview

10

Static

static

3

2026-11-03...at.exe

windows10-2004-x64

10

2026-11-03...at.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-03_9c3b440ba0c4c4ea2127461bbfb32912_icedid_njrat
  • Size 1.1MB
  • Sample261104-pxdcsade53
  • SHA256 f42a2c3ac9d9fc25f88c8278b705bfd8bcf02cba0e648e429aa88519c823e364
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gomoratsheetratтестdiscoveryrattrojan

Malware Config

Extracted

Family

  • gomorat

Version

  • 1.8

Botnet

  • тест

C2

  • 185.99.97.203:9000

Mutex

  • tcg4gu#4sb&%fq3^2

Attributes
  • antivirtual

    true

  • certificate

    z3j1vwvrovyhd6u3k3

  • delay_unit

    Seconds

  • delay_value

    5

  • disk_spread

    false

  • enable_delay

    false

  • exclusion_wd

    false

  • hidden_file

    false

  • install

    true

  • install_watchdog

    false

  • key

    tdrobneinhx

  • path_client

    %ProgramFiles%\Search.exe

  • path_watchdog

    31$ewgo)hi%!y(ael0i_vj7^37x4@2*

  • pump

    false

  • rootkit

    false

  • rootkit_type

    disabled

  • task_client

    ShellHost

  • task_watchdog

    veg3&$f

  • usb_spread

    false

  • use_install_admin

    false

  • user_init

    false

  • winlogon_shell_enable

    false

  • wmi_name

    WindowsDefender

  • wmi_startup

    false

Targets

    • Target
      2026-11-03_9c3b440ba0c4c4ea2127461bbfb32912_icedid_njrat
    • Size 1.1MB
    • SHA256 f42a2c3ac9d9fc25f88c8278b705bfd8bcf02cba0e648e429aa88519c823e364
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    тестdiscoverygomoratsheetratrattrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: GomoRAT

      GomoRAT is a Windows RAT written in C#.

      ratgomorat

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks