MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SheetRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 15 File information Comments

SHA256 hash:	6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f
SHA3-384 hash:	b38eaf44300beb2e922223f8d95553f1e07e6b3285d5e057544e9337474fd848c014688849159d166c85d8eda33b63e9
SHA1 hash:	5b12b095acbd1db83026eb4efadf4ec63ad18515
MD5 hash:	b75540e7ca4ed6b7d33735071f676ead
humanhash:	cup-alaska-virginia-oklahoma
File name:	ZeninDLC.exe
Download:	download sample
Signature	SheetRAT Create hunting rule
File size:	475'648 bytes
First seen:	2026-02-05 16:31:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:Zy9wz4ZoeETEW1gbpJA3KpSL0pDpTpWEdMppLOGPHGx+Rf3VtDybX:Zy9ULePJA3KY0pNYEdYGx+Rf3Da
TLSH	T109A4AD03BAD100BED8BE813948675615A77AF4218B62EBEB139405FD0F277C69D38F52
TrID	36.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 23.5% (.EXE) Win64 Executable (generic) (10522/11/4) 11.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.0% (.EXE) Win32 Executable (generic) (4504/4/1) 4.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	burger
Tags:	exe r77 rootkit SheetRat

Intelligence

File Origin

# of uploads :

# of downloads :

322

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PostExploitTool

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7db120a8-d4ce-40e1-bc45-f61768ef52ab/

Malware family:

n/a

ID:

File name:

ZeninDLC.exe

Verdict:

No threats detected

Analysis date:

2026-02-05 16:30:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/608b03e5-7cdf-4b62-8636-7f8e5ce056fe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

R77

Link:

https://www.capesandbox.com/analysis/52440/

Detection(s):

Win.Malware.Cerbu-10058200-0

Win.Malware.Lazy-10008179-0

Win.Malware.Lazy-10008180-0

Win.Rootkit.R77-10009365-0

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6984c5b7ae5379bb6609d4a8

Tags:

vmdetect emotet

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm anti-vm anti-vm base64 evasive exploit explorer fingerprint lolbin lolbin msbuild netsh obfuscated reconnaissance schtasks zusy

Link:

https://www.filescan.io/uploads/6984c60a930564ff3c8d4ad9/reports/65a91df2-16d5-49d3-a62b-b647a47b4dd5/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-02-05T13:28:00Z UTC

Last seen:

2026-02-07T11:44:00Z UTC

Hits:

~10

Detections:

Trojan.MSIL.DInvoke.sb HEUR:Trojan.Win32.Generic HEUR:Trojan.MSIL.Shelpak.gen HEUR:Trojan.MSIL.Agent.gen HEUR:Rootkit.Win64.Agent.gen HEUR:HackTool.MSIL.EtwHook.gen Trojan.MSIL.Inject.sb

Link:

https://opentip.kaspersky.com/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f/results?tab=lookup

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e03686fe-8916-488f-87e8-6f4c191c6ee9

Result

Threat name:

SheetRat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1864174

Signature

.NET source code contains potential unpacker

.NET source code contains process injector

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Contains functionality to capture screen (.Net source)

Found malware configuration

Multi AV Scanner detection for submitted file

Queries memory information (via WMI often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected SheetRat

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f/

Verdict:

Malicious

Threat:

Family.SHEETRAT

Link:

https://tip.neiki.dev/file/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f

Threat name:

ByteCode-MSIL.Backdoor.AsyncRAT

Status:

Malicious

First seen:

2026-02-05 16:30:53 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nsetbnotc2eqfyeav7s7vufnv24js5pxa25arzzy2hxb7oxan2hq._file

Verdict:

malicious

Label(s):

r77rootkit

Similar samples:

error

SheetRAT

Result

Malware family:

sheetrat

Score:

10/10

Tags:

family:sheetrat defense_evasion trojan

Link:

https://tria.ge/reports/260205-t11ppsdz8d/

Behaviour

Checks SCSI registry key(s)

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Checks BIOS information in registry

Executes dropped EXE

Indicator Removal: Clear Windows Event Logs

Loads dropped DLL

Detects Sheetrat Payload

Sheetrat family

Sheetrat, NonEuclid rat

Unpacked files

SH256 hash:

6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f

MD5 hash:

b75540e7ca4ed6b7d33735071f676ead

SHA1 hash:

5b12b095acbd1db83026eb4efadf4ec63ad18515

Link:

https://www.unpac.me/results/1eaf2a8f-1b54-4d44-9112-2567bdd04be1/

SH256 hash:

ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a

MD5 hash:

6295c384c45ef898b40608f7af8155db

SHA1 hash:

75111839c370518271e1b625f506062f7ab31c3a

Detections:

MALWARE_Win_R77

Link:

https://www.unpac.me/results/1eaf2a8f-1b54-4d44-9112-2567bdd04be1/

Parent samples :

a04ee025d13c0be594ecc7d52bbb586b3003205091fd8234e7462431ee857615
6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f
364d3883e81da01bb449083552e5f1526ec734bdf40b27e71a4670fc3df12e76
0ffec6082c9540ac473d603f278168458f574ac9018ba5ed9b7b1e7ec1539133
63a58a8d5cce2d17a2818f47e8c23ac080b6d4314369b56f31f2ad65f09384cf

SH256 hash:

842b6311b3fceab40ce2892faa37b2f5e52a3fc762e6211b1eb879ab32af1b3f

MD5 hash:

a76b1d1b785329169388027f95059349

SHA1 hash:

bf901e82be9787e8f07169916c277ee02aa99805

Detections:

MALWARE_Win_R77

Link:

https://www.unpac.me/results/1eaf2a8f-1b54-4d44-9112-2567bdd04be1/

Parent samples :

a04ee025d13c0be594ecc7d52bbb586b3003205091fd8234e7462431ee857615
6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f
6437c30cb1a5d692f9aa0b1614b7889a01313c7bf9de788ced4de3652bf901d5
27a2505cfd32ca1fda31e58c1d2ddee7e4726b8305fda10b779851e259a2ef9d
be578f42ec4601a6a3c90acbbf26450aaba7288c4a8019fd4dbd23924326bfb4
efa4b5a4c5427d34279857cff2b25c40da8c4b7ea39af7c9e89c3e30d0c232cf
364d3883e81da01bb449083552e5f1526ec734bdf40b27e71a4670fc3df12e76
0ffec6082c9540ac473d603f278168458f574ac9018ba5ed9b7b1e7ec1539133
63a58a8d5cce2d17a2818f47e8c23ac080b6d4314369b56f31f2ad65f09384cf

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6c8930b5d316/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	MALWARE_Win_R77 Create hunting rule
Author:	ditekSHen
Description:	Detects r77 rootkit

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Rootkit_R77_d0367e28 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/52440/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample