Malware

SheetRAT

SheetRAT is a modular .NET remote access trojan (RAT) for Windows. Public reporting cited here describes it as a previously unreported malware family first publicly analyzed by Breakglass Intelligence in March 2026, with multiple MalwareBazaar samples observed between March 29 and April 1, 2026. Observed samples were .NET Framework 4.0 binaries, and reporting states the malware is distributed openly as a GitHub builder kit with 32 plugin DLLs and configuration templates.

Reported command-and-control does not use Google Sheets despite the name; instead, SheetRAT uses Pinggy tunnel infrastructure, including subdomains matching *[.]a[.]free[.]pinggy[.]link on arbitrary ports, allowing C2 traffic to blend with legitimate encrypted traffic to pinggy.link infrastructure. Recovered artifacts included a version string 2.6.4, a dropped DLL name xdwd.dll, an external IP discovery URL hxxps://api64[.]ipify[.]org/, and masquerade filenames such as Google SketchUp Update.exe, OBS Studio.exe, and RuntimeBroker.exe.

Capabilities described in the reporting include remote desktop control, webcam/camera access, microphone capture, keylogging, screenshots, clipboard monitoring, credential theft, file management, shell access, registry and service manipulation, scheduled tasks, autorun, SMB worming, file binding propagation, Monero and Ethereum Classic mining, DDoS, reverse proxying, geolocation, UAC bypass, and system disabling. Persistence mechanisms mentioned include HKCU and HKLM Run keys, scheduled tasks, Startup folder placement, Winlogon Userinit hijacking, AppInit_DLLs injection, and registry-based persistence.

Defense evasion and anti-analysis features directly mentioned include AMSI and ETW bypass, Windows Defender exclusion via WMI MSFT_MpPreference ExclusionPath modification, WMI-based virtual machine detection, sandbox DLL checks, process killing, masquerading, ConfuserEx-style obfuscation, and per-build monoalphabetic substitution obfuscation of strings. Reported sandbox/analysis-related DLL names include SbieDll.dll, snxhk.dll, cmdvrt32.dll, and Sf2.dll. Reported process kill targets include taskmgr.exe, ProcessHacker.exe, and procexp.exe. The malware also reportedly forges its PE compilation timestamp to 2100-10-13.

Operational context in the reporting links SheetRAT to malicious infrastructure that also supported Nexus Android banking trojan activity, phishing kits, and a crypto drainer. MalwareBazaar reportedly hosted more than 10 SheetRAT samples associated with that infrastructure. Another report linked SheetRAT sightings to infrastructure in AS202412 / OMEGATECH alongside multiple other malware families. Attribution remains low-to-medium confidence; embedded artifacts including the PDB path C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Client\obj\Release\Client.pdb and Russian-language GitHub repository descriptions were assessed as suggesting a Russian-speaking developer or development community.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

Multi-Layer Persistence : The builder can enable any combination of five persistence mechanisms simultaneously: Registry Run keys (HKCU and HKLM) Scheduled tasks (OnLogon trigger + recurring interval)

T1204.002Malicious FileEvidence1

MITRE ATT&CK Coverage Tactic Technique ID Execution User Execution T1204.002

Persistence

5 techniques

T1053.005Scheduled TaskEvidence1

T1546.010AppInit DLLsEvidence1

Multi-Layer Persistence : The builder can enable any combination of five persistence mechanisms simultaneously... AppInit_DLLs registry injection

T1547Boot or Logon Autostart ExecutionEvidence1

NONEUCLID RAT is equipped with features such as a rootkit, autoload functionality, and a User Account Control (UAC) bypass. These functionalities allow the malware to maintain persistence on infected systems and evade detection.

T1547.001Registry Run Keys / Startup FolderEvidence2

Registry-based persistence

T1547.004Winlogon Helper DLLEvidence1

Multi-Layer Persistence : The builder can enable any combination of five persistence mechanisms simultaneously... Userinit registry hijack (Winlogon)

Privilege Escalation

6 techniques

T1053.005Scheduled TaskEvidence1

T1546.010AppInit DLLsEvidence1

Multi-Layer Persistence : The builder can enable any combination of five persistence mechanisms simultaneously... AppInit_DLLs registry injection

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence2

Registry-based persistence

T1547.004Winlogon Helper DLLEvidence1

Multi-Layer Persistence : The builder can enable any combination of five persistence mechanisms simultaneously... Userinit registry hijack (Winlogon)

T1548.002Bypass User Account ControlEvidence2

NONEUCLID RAT is equipped with features such as a rootkit, autoload functionality, and a User Account Control (UAC) bypass.

Stealth

6 techniques

T1014RootkitEvidence1

NONEUCLID RAT is equipped with features such as a rootkit, autoload functionality, and a User Account Control (UAC) bypass.

T1027Obfuscated Files or InformationEvidence3

Additionally, NONEUCLID employs obfuscation techniques and anti-debugging mechanisms to make reverse engineering and analysis by security researchers more challenging.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Masquerading : Copies itself using legitimate-sounding filenames: Google SketchUp Update.exe , OBS Studio.exe , RuntimeBroker.exe

T1497Virtualization/Sandbox EvasionEvidence1

WMI-based virtual machine detection to avoid sandbox analysis

T1497.001System ChecksEvidence1

Sandbox Detection : Checks for the presence of known sandbox DLLs ( SbieDll.dll for Sandboxie, snxhk.dll for Avast, cmdvrt32.dll for Comodo, Sf2.dll for Avast sandbox). If any are found, the malware alters its behavior.

T1622Debugger EvasionEvidence1

Additionally, NONEUCLID employs obfuscation techniques and anti-debugging mechanisms to make reverse engineering and analysis by security researchers more challenging.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Surveillance : ... Keylogger ... MITRE ATT&CK Coverage... Collection Keylogging T1056.001

T1555Credentials from Password StoresEvidence1

Data Theft : Stealer (602 KB, browser credentials and stored data)... MITRE ATT&CK Coverage... Credential Access Credentials from Stores T1555

Discovery

3 techniques

T1497Virtualization/Sandbox EvasionEvidence1

WMI-based virtual machine detection to avoid sandbox analysis

T1497.001System ChecksEvidence1

T1622Debugger EvasionEvidence1

Additionally, NONEUCLID employs obfuscation techniques and anti-debugging mechanisms to make reverse engineering and analysis by security researchers more challenging.

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

Lateral Movement : WormSMB (SMB network worm)... MITRE ATT&CK Coverage... Lateral Movement SMB/Windows Admin Shares T1021.002

Collection

6 techniques

T1005Data from Local SystemEvidence1

SheetRAT -- Windows RAT for desktop access, surveillance, and data exfiltration

T1056.001KeyloggingEvidence1

Surveillance : ... Keylogger ... MITRE ATT&CK Coverage... Collection Keylogging T1056.001

T1113Screen CaptureEvidence1

Surveillance : ... Images (screenshot capture) ... MITRE ATT&CK Coverage... Collection Screen Capture T1113

T1115Clipboard DataEvidence1

Surveillance : ... Clipboard monitoring ... MITRE ATT&CK Coverage... Collection Clipboard Data T1115

T1123Audio CaptureEvidence1

Surveillance : ... MicroPhone (audio recording) ... MITRE ATT&CK Coverage... Collection Audio Capture T1123

T1125Video CaptureEvidence2

Camera access capability

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

When @Fact_Finder03 flagged 158.94.210[.]91 as a C2 panel... The /24 subnet surrounding that IP hosts 67 distinct command-and-control operations spanning 16 malware families.

T1071.001Web ProtocolsEvidence1

The victim's machine makes what appears to be a standard HTTPS connection to a subdomain of pinggy.link... MITRE ATT&CK Coverage... C2 Application Layer Protocol T1071.001

T1219Remote Access ToolsEvidence1

SheetRAT is a .NET remote access trojan

T1572Protocol TunnelingEvidence1

The actual C2 mechanism is Pinggy -- a legitimate TCP/HTTP tunnel service... every infected victim beacons out to a Pinggy-assigned subdomain... MITRE ATT&CK Coverage... C2 Protocol Tunneling T1572

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

MITRE ATT&CK Coverage... Exfiltration Over C2 Channel T1041

Impact

2 techniques

T1496Resource HijackingEvidence1

Monetization : MinerXmr (Monero mining), MinerEtc (Ethereum Classic mining)... MITRE ATT&CK Coverage... Impact Resource Hijacking T1496

T1498Network Denial of ServiceEvidence2

Cybersecurity analysts warn that the malware’s botnet capabilities could be exploited for large-scale attacks, including Distributed Denial-of-Service (DDoS) operations or data exfiltration campaigns.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

AMSI and ETW bypass for evasion of Windows security telemetry

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app25 days ago

ip.v4●●●●●●●●●●●●View more in app6 months ago

domain●●●●●●●●●●●●View more in app6 months ago

hash.sha256●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

breakglass intelNews

Apr 3, 2026

Block One ASN, Kill Sixteen Malware Families: Mapping OMEGATECH, a Three-Month-Old Bulletproof Hosting Network Running 67 C2 Servers on a Single Subnet - Breakglass Intelligence - Breakglass Intelligence

Remote access trojan family identified as sharing the same bulletproof hosting subnet.

breakglass intelNews

Apr 3, 2026

One DigitalOcean Droplet, Six Phishing Brands, and an Unprotected Nexus C2 Panel: Inside a Converged Criminal Operation - Breakglass Intelligence - Breakglass Intelligence

A .NET remote access trojan for Windows that includes AMSI and ETW bypasses, WMI-based VM detection, registry persistence, camera access, and obfuscation. It is described as being under active development and used for desktop access, surveillance, and data exfiltration.

breakglass intelNews

Apr 1, 2026

SheetRAT Has Nothing to Do With Sheets: Inside a 32-Plugin RAT Builder Using Pinggy Tunnels as Unblockable C2 - Breakglass Intelligence - Breakglass Intelligence

A modular .NET remote access trojan/backdoor framework with a builder kit and 32 plugins. It uses Pinggy TCP tunnels for C2, obfuscates strings with a per-build monoalphabetic substitution cipher, supports credential theft, keylogging, screen/audio/video capture, file management, persistence, UAC bypass, sandbox evasion, process killing, lateral movement via SMB worming, crypto mining, DDoS, and reverse proxying.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SheetRAT