Overview

overview

10

Static

static

10

see3.ps1

windows10-2004-x64

10

Resubmissions

04/11/2026, 18:44

261104-xdmfcacw4v10

04/11/2026, 00:21

261104-ana4qsxtft10

Sharing

Copy URL Twitter E-mail

General

  • Target
    see3.ps1
  • Size 4KB
  • Sample261104-xdmfcacw4v
  • SHA256 d65fed8b11f15086fd4024678bd487c0b0bdc144fab2be12d4fb37239156ef07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloadersheetratayuexecutionloadertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://bvmatqnam.com.vn/js/pp10.bin

Extracted

Family

  • sheetrat

Version

  • 1.8

Campaign

  • AYU

C2

  • wuohzjgoj.localto.net:3837

Mutex

Attributes
  • anti_virtual

    false

  • certificate

    wnem76c5s1bgpucn

  • install

    false

  • key

    b9sv30zmw

  • path_watch_dog

    69)qrk5

  • rootkit

    akyyJj3Ja

  • use_install_admin

    9f)mc0sndjvwho

Targets

    • Target
      see3.ps1
    • Size 4KB
    • SHA256 d65fed8b11f15086fd4024678bd487c0b0bdc144fab2be12d4fb37239156ef07
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ayuexecutiondonutloadersheetratloadertrojan

    • Detects DonutLoader

      loader

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks