SheetAgent RAT Runs 14 Virtual Machine Checks and Self-Deletes When Analysis Is Detected

A threat campaign targeting Indian government job seekers is using a recruitment notice for Senior Field Officer positions in the Cabinet Secretariat as a lure to deploy a custom remote access Trojan, SheetAgent RAT.

The campaign begins with a ZIP archive named Approved Documents 2026.pdf.zip, which masquerades as a document-verification package.

Its contents include a malicious LNK shortcut, Document-24062026-Y6352634.lnk; a hidden PowerShell script, JT-agenda.ps1; and a hidden .NET executable, Document.exe.

The shortcut uses a Microsoft Edge icon to appear benign and invokes PowerShell in hidden, non-interactive mode.

The script downloads and installs a legitimate ControlR remote monitoring and management agent from demo.controlr.app, enrolling the victim device into an attacker-controlled ControlR tenant.

The installer is signed by Bitbound, illustrating how legitimate RMM platforms can be repurposed to establish persistent, hands-on remote access.

After the ControlR installation, the PowerShell script runs Document.exe, a 32- or 64-bit .NET dropper. The binary creates a masqueraded directory at %APPDATA%\Microsoft\WinSyncDefender\ and extracts two embedded files: a decoy-document shortcut and agent.exe, the final SheetAgent payload.

The loader renames the RAT as WindowsDefenderSyncService.exe to blend into the host environment.

For persistence, the malware first attempts to create a scheduled task named WindowsDefenderSyncService. The task launches the RAT at user logon and every three minutes afterward.

If task creation fails, it falls back to a Startup-folder shortcut named WindowsDefenderSync.lnk, described as “Windows Netlogon System Synchronization Service.”

The accompanying decoy shortcut downloads and opens a PDF impersonating an Employment News recruitment notice dated June 131313–191919, 202620262026.

Researchers at the Seqrite APT Research Team linked the activity to a multi-stage intrusion chain that combines malicious shortcuts, PowerShell, legitimate remote-management software, Google Workspace APIs, and anti-analysis controls.

The document advertises Cabinet Secretariat Senior Field Officer Technical roles, including eligibility, GATE score requirements, vacancies, and application instructions. It is hosted on infrastructure resolving to 38[.]242[.]157[.]89.

SheetAgent establishes a backup command-and-control channel through attacker-controlled Google Sheets and Google Drive resources.

SheetAgent RAT Runs 14 Virtual Machine

The RAT contains hardcoded Google service-account credentials, including a complete RSA private key, enabling it to authenticate to Sheets and Drive APIs.

It records infected hostnames, timestamps, public IP addresses, operational status, commands, and command output in predefined spreadsheet columns.

The RAT checks whether a victim hostname already exists in Column A of the sheet. If no matching system is found, it registers the host in the next available row.

It then repeatedly retrieves operator commands from Column C, executes them locally, and sends results to Column D. This approach allows attackers to hide malicious traffic within trusted Google infrastructure.

Before connecting to its C2, SheetAgent invokes an IsRunningInVirtualMachine() routine containing 141414 anti-analysis checks.

The malware examines WMI manufacturer and BIOS data, disk and GPU information, VM-related processes, registry artifacts, MAC-address prefixes, drivers, services, and installation paths associated with VMware and VirtualBox.

It also searches for sandbox indicators, including Any.Run and Triage artifacts, alongside analyst-style usernames and VM-specific devices.

If any check identifies a virtualized or monitored system, SheetAgent launches a cleanup routine. It writes cleanup.bat into %TEMP%, delays execution, forcibly removes its executable and service.json configuration file, deletes the batch file, and exits.

This self-deletion capability can complicate malware triage and reduce forensic evidence on research systems.

Seqrite also identified SecureMonitor, PrivateRat, and another password-protected management panel on ports 900090009000, 700070007000, and 800080008000 of the same server.

The PrivateRat interface referenced a developer named “HeartMelt.” Researchers assess with medium confidence that the campaign is associated with APT36, citing its India-focused targeting, Google Sheets C2 use, .NET tooling, and persistence tradecraft.

IOCs

Approved Documents 2026.pdf.zip	2b33b5185e93e1655eb27dbaa025d7ee088627db3d640fe4709be705646b189c
Document.exe	ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210
Document-24062026-Y6352634.lnk	434243e615b93a1b948c26ad55902bd78f9fa18e42375c15790634375c1ad3f4
JT-agenda.ps1	70fe7576f20f5dd6a3d872753c922f1394d91487f5eabb417b240b83c22e31b2
ControlR.Agent.Installer.exe	cf3f1bceb83fa3acefbabae4bdc275347cfe03dd7fc770052a33baef204a89f7
MicrosoftSyncService.exe	b928e523b51187b932e48a65d36ce3d0c39ee9d409d493b90f98cf3d1e0e73b0
Document.lnk	c4859db541b2bd0d266bbc44fafb5a767c862a57a3633a949dfaeebdf88ed529
file.pdf	fd2ac3a761f66dc6954014532795f9108f65739f23e4b294d4563673b799688

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide