🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SheetRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada
SHA3-384 hash: 33bf5cb8728a75d9c7fc24a6ec7b88e6fccac107947f3fadd789f4fececb2dd6d25b50886ef4cb3b89f5dd7ec2109d61
SHA1 hash: cf902893a232de1c4e07b3d207e2fba81bf4aedf
MD5 hash: 8a9ff886cb5880ed2e2345cb3948c73f
humanhash: hot-bacon-grey-virginia
File name:limclean.bat
Download: download sample
Signature SheetRAT
Create hunting rule
File size:6'414'204 bytes
First seen:2026-10-05 12:54:02 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 49152:VbQ8XLQygKiRO5FzresM8c/9uWBVPH1FBfB+ZevBcF7rIvBKBR3Z:P
TLSH T19356140E7E4C1656CF2165FF702E8F09767204CB0A61AC50BD67796AADEA7C0B10C9E7
Magika batch
Reporter smica83
Tags:bat SheetRat

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e82cc193-22a1-424a-9f0a-e1c514226012/
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-10-05 13:12:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8855b7ef-9d82-4299-a808-6ed612a6584c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90707/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Delayed reading of the file
Delayed writing of the file
Launching a service
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-vm
Link:
https://www.filescan.io/uploads/6ac39df882af77f74b7f5d4a/reports/02ee8186-9b46-415c-a74d-d541e63cf3b4/overview
Verdict:
Suspicious
Labled as:
BAT/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada
Verdict:
Clean
File Type:
unix shell
First seen:
2026-10-05T13:06:00Z UTC
Last seen:
2026-10-07T05:19:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada/results?tab=lookup
Result
Threat name:
SheetRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1982401
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found large BAT file
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Legitimate Application Dropped Script
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Powershell download and execute
Yara detected SheetRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1982401 Sample: limclean.bat Startdate: 05/10/2026 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for URL or domain 2->48 50 10 other signatures 2->50 9 cmd.exe 2 2->9         started        process3 signatures4 58 Suspicious powershell command line found 9->58 60 Uses ping.exe to sleep 9->60 62 Bypasses PowerShell execution policy 9->62 64 Uses ping.exe to check the status of other devices and networks 9->64 12 powershell.exe 19 9->12         started        15 certutil.exe 3 2 9->15         started        17 conhost.exe 9->17         started        19 timeout.exe 1 9->19         started        process5 signatures6 66 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->66 68 Found suspicious powershell code related to unpacking or dynamic code loading 12->68 21 tmp8184.tmp.exe 5 12->21         started        70 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 15->70 process7 file8 38 C:\Users\user\...\adv4iqbsd1fsq59w.exe, PE32+ 21->38 dropped 40 C:\Users\user\AppData\Local\...\limfucker.bat, DOS 21->40 dropped 24 adv4iqbsd1fsq59w.exe 1 21->24         started        27 cmd.exe 1 21->27         started        process9 signatures10 52 Antivirus detection for dropped file 24->52 54 Queries memory information (via WMI often done to detect virtual machines) 24->54 56 Uses ping.exe to sleep 27->56 29 PING.EXE 1 27->29         started        32 conhost.exe 27->32         started        34 PING.EXE 1 27->34         started        36 chcp.com 1 27->36         started        process11 dnsIp12 42 127.0.0.1 unknown unknown 29->42
Score:
72%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-05 12:54:20 UTC
File Type:
Text (Batch)
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rli6qg2rdllwudokotjz3avy26js2wcnebd7wybldlsn2lvwxlna._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261005-p5btxstblc/
Behaviour
Delays execution with timeout.exe
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Deobfuscate/Decode Files or Information
Enumerates connected drives
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/90707/

Comments