MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SheetRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164
SHA3-384 hash: f47e69018051156289d9a5dbb886d9d83aeaf60767afdee61ab8c5ac69ae033a6f03b4b0f4e5818e57d257dc1cae1220
SHA1 hash: 267c3a43ce85f479979f1b2110f281b402b60426
MD5 hash: 189b2cdfdd8a5efb2c737a23ca7a920e
humanhash: lion-don-beryllium-nebraska
File name:Plague.exe.bin
Download: download sample
Signature SheetRAT
Create hunting rule
File size:103'936 bytes
First seen:2025-08-12 13:03:20 UTC
Last seen:2025-08-13 15:24:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:qyU9NAjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uC8AlZImxWL9bfwmb4:DVNeN3w/jhlhE1Z8Nig9bZImw9bf7U
Threatray 42 similar samples on MalwareBazaar
TLSH T137A3BE6173D785E6F27E0CF859A7A10882B0E6236603DB0A5CFBE0D516967C4C672DD2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter zhuzhu0009
Tags:exe SheetRat

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
JP JP
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Plague.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 12:56:55 UTC
Tags:
auto-sch sheet rat auto-reg
Link:
https://app.any.run/tasks/040ab4ec-61f0-4372-85a3-2ebd63c6c35b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20350/
Detection(s):
Win.Trojan.AsyncRAT-9914220-0
Create hunting rule

Win.Packed.Marsilia-10021147-0
Create hunting rule

Win.Packed.Packy-10036375-0
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b3a15fca70bd90e8ef6f0
Tags:
autorun shell spawn sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Running batch commands
Creating a file
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Connection attempt to an infection source
Creating a window
Creating a file in the Windows directory
Enabling the libraries to load when starting the app (AppInit_DLLs)
Connection attempt
Searching for synchronization primitives
Launching a service
Loading a suspicious library
Query of malicious DNS domain
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Enabling autorun by creating a file
Enabling autorun
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 masquerade obfuscated packed reconnaissance vbnet
Link:
https://www.filescan.io/uploads/689b3ba2167d60d98ab6d904/reports/d228b5f3-5ba4-4469-a7f7-62482251fb7b/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc03e5d1-ea70-4504-8421-55a3bed06bb2
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164/
Verdict:
Malicious
Threat:
HEUR:Trojan.MSIL.Xdwd
Link:
https://tip.neiki.dev/file/048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164
Threat name:
Win32.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2025-08-12 12:56:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
32 of 38 (84.21%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=asg6hkesroxq4nancmy7jm6zwek4pr5d6ceelhu3fyxnmcch6fsa._file
Verdict:
malicious
Label(s):
balkanrat
Create hunting rule
Similar samples:
018f9ba428f4e3360bb6ee7c42f5f475bda12ae71a430d603a4a5e8ea94fdcf9
SheetRAT
06d67f64685d6851e45d6f0861c277f47e6331fbd69b234ef23073e88d880fad
SheetRAT
29ecf946a40c89dfae84770c96f483b151a636202ceaab43b1c8008f2adedbea
SheetRAT
47767a97c828554f2092c5e2fc505e103ff42114cd75071fd69e16111037a83a
SheetRAT
57d596b29d6fc2c917503116419917c74d504be7733b31ac4637b6792e8abf72
SheetRAT
9de2d029ed9820365edfee67a095513aef305825f665e0acc0dbc56081252c9c
SheetRAT
e66a08612641e3fb9ed31747e08dc00c0a9d53155fc1565baafcddd7d1b9ce1e
SheetRAT
e67edd1c28b2e06c3be00d3116a1ed0dee0835d6de2efa6f85b9aa8c8489b230
SheetRAT
error
SheetRAT
f8626f86d774c3d65f29ae1c31c77eae9101ebc135446989307754498fb15bfa
SheetRAT
ff53ea407afca08ff7555f895686fb71cc858cfd51725efc6a678c2b202f31f4
SheetRAT
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/250812-qakn1scp7x/
Behaviour
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Event Triggered Execution: AppInit DLLs
Modifies WinLogon for persistence
Verdict:
Malicious
Tags:
Win.Trojan.AsyncRAT-9914220-0
YARA:
n/a
Link:
https://app.threat.zone/submission/436541fe-de29-47eb-a4ff-2bdc6bbb1fa2
Unpacked files
SH256 hash:
048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164
MD5 hash:
189b2cdfdd8a5efb2c737a23ca7a920e
SHA1 hash:
267c3a43ce85f479979f1b2110f281b402b60426
Link:
https://www.unpac.me/results/54154a6e-e47f-4022-ad9f-5f0311b4045c/
SH256 hash:
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 hash:
16e5a492c9c6ae34c59683be9c51fa31
SHA1 hash:
97031b41f5c56f371c28ae0d62a2df7d585adaba
Link:
https://www.unpac.me/results/54154a6e-e47f-4022-ad9f-5f0311b4045c/
Malware family:
Alcatraz
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/048de3a8928b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/048de3a8928baf0e340d1331f4b3d9b115c7c7a3f088459e9b2e2ed60847f164

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/040ab4ec-61f0-4372-85a3-2ebd63c6c35b
Cape
Cape
https://www.capesandbox.com/analysis/20350/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments